Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

possible free statically allocated string in compiler when easter egg on #78265

Closed
zhangyangyu opened this issue Jul 10, 2018 · 13 comments
Closed
Labels
3.7 (EOL) end of life 3.8 only security fixes easy

Comments

@zhangyangyu
Copy link
Member

BPO 34084
Nosy @warsaw, @vstinner, @serhiy-storchaka, @zhangyangyu
PRs
  • bpo-34080: Fix memory leak on parsing error #8242
  • bpo-34084: Remove parser deadcode for Barry as BDFL #8259
  • bpo-34084: Fix setting an error message for the "Barry as BDFL" easter egg. #8262
  • [3.7] bpo-34084: Fix setting an error message for the "Barry as BDFL" easter egg. (GH-8262) #8423
  • [3.6] bpo-34084: Fix setting an error message for the "Barry as BDFL" easter egg. (GH-8262) #8424
  • Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
    closed_at = <Date 2018-07-24.08:09:32.943>
    created_at = <Date 2018-07-10.11:37:01.875>
    labels = ['easy', '3.7', '3.8']
    title = 'possible free statically allocated string in compiler when easter egg on'
    updated_at = <Date 2018-07-24.08:09:32.943>
    user = 'https://github.com/zhangyangyu'

    bugs.python.org fields:

    activity = <Date 2018-07-24.08:09:32.943>
    actor = 'serhiy.storchaka'
    assignee = 'none'
    closed = True
    closed_date = <Date 2018-07-24.08:09:32.943>
    closer = 'serhiy.storchaka'
    components = []
    creation = <Date 2018-07-10.11:37:01.875>
    creator = 'xiang.zhang'
    dependencies = []
    files = []
    hgrepos = []
    issue_num = 34084
    keywords = ['patch', 'easy']
    message_count = 13.0
    messages = ['321381', '321382', '321418', '321420', '321421', '321425', '321429', '321487', '321522', '321525', '322256', '322270', '322271']
    nosy_count = 4.0
    nosy_names = ['barry', 'vstinner', 'serhiy.storchaka', 'xiang.zhang']
    pr_nums = ['8242', '8259', '8262', '8423', '8424']
    priority = 'normal'
    resolution = 'fixed'
    stage = 'resolved'
    status = 'closed'
    superseder = None
    type = None
    url = 'https://bugs.python.org/issue34084'
    versions = ['Python 3.6', 'Python 3.7', 'Python 3.8']

    @zhangyangyu
    Copy link
    Member Author

    While reviewing PR8222, I found err_ret->text is assigned a not malloced string, but it will finally get freed in err_input.

    @zhangyangyu zhangyangyu added 3.7 (EOL) end of life 3.8 only security fixes easy labels Jul 10, 2018
    @zhangyangyu zhangyangyu changed the title possible free statically allocated string possible free statically allocated string in compiler when easter egg on Jul 10, 2018
    @serhiy-storchaka
    Copy link
    Member

    I expected it should be easy to reproduce a crash, but I failed to find an example.

    @vstinner
    Copy link
    Member

    This issue is related to bpo-34080.

    @vstinner
    Copy link
    Member

    I expected it should be easy to reproduce a crash, but I failed to find an example.

    I don't understand how parsetok.c is supposed to handle "from __future__ import barry_as_FLUFL":

    • Parser/parsetok.c tests (ps->p_flags & CO_FUTURE_BARRY_AS_BDFL)
    • Python/future.c uses "if (strcmp(feature, FUTURE_BARRY_AS_BDFL) == 0) { ff->ff_features |= CO_FUTURE_BARRY_AS_BDFL; }"
    • Python/pythonrun.c: PARSER_FLAGS() copies CO_FUTURE_BARRY_AS_BDFL flag as PyPARSE_BARRY_AS_BDFL

    The only way to use "<>" operator seems to pass explicitly CO_FUTURE_BARRY_AS_BDFL flag to compile() flags, which is not the convenient way to use "from __future__ import barry_as_FLUFL" :-(

    Code:
    ---

    import inspect
    CO_FUTURE_BARRY_AS_BDFL = 0x40000
    flags = CO_FUTURE_BARRY_AS_BDFL
    code = "print(1 <> 2)"
    try:
        compile(code, "filename", "exec", flags=0)
    except SyntaxError:
        print("ok")
    else:
        raise Exception("SyntaxError expected")
    compile(code, "filename", "exec", flags=flags)
    print("ok")

    Maybe we need a test for the easter egg. Or maybe we should remove it? :-p

    @vstinner
    Copy link
    Member

    Oh, this easter egg is tested by Lib/test/test_flufl.py.

    @serhiy-storchaka
    Copy link
    Member

    Could you add a test in test_flufl.py that will fail with not patched code?

    This issue and bpo-34080 look unrelated to me. They can be fixed independently.

    @vstinner
    Copy link
    Member

    Could you add a test in test_flufl.py that will fail with not patched code?

    It seems like PyObject_FREE() is never called with the static string "with Barry as BDFL, use '<>' instead of '!='".

    When parsetok() goes to code path (1):

                err_ret->text = "with Barry as BDFL, use '<>' "
                                "instead of '!='";
    

    Later, it goes to code path (2) as well:

            if (tok->buf != NULL) {
                ...
                err_ret->text = (char *) PyObject_MALLOC(len + 1);

    Hum, I modified my PR to removed *dead code*:

                err_ret->text = "with Barry as BDFL, use '<>' "
                                "instead of '!='";
    

    This issue and bpo-34080 look unrelated to me. They can be fixed independently.

    In practice, both issues are related and it seems easier to me to fix them both at the same time ;-)

    @warsaw
    Copy link
    Member

    warsaw commented Jul 11, 2018

    AFAICT, that future only works in the REPL.

    @serhiy-storchaka
    Copy link
    Member

    PR 8262 fixes the intended setting of error message for the "Barry as BDFL" easter egg.

    >>> from __future__ import barry_as_FLUFL
    >>> 1 != 2
      File "<stdin>", line 1
        1 != 2
           ^
    SyntaxError: with Barry as BDFL, use '<>' instead of '!='

    But there is other problem. As was exposed in the private communication with Victor and Barry, this easter egg works only in REPL (or if explicitly pass __future__.CO_FUTURE_BARRY_AS_BDFL to compile()). I'll try to fix this too.

    @serhiy-storchaka
    Copy link
    Member

    The problem is that 'from __future__ import' is parsed after converting the sources to the AST. But this flag affects the behavior of the tokenizer, before an AST is created.

    @serhiy-storchaka
    Copy link
    Member

    New changeset aba24ff by Serhiy Storchaka in branch 'master':
    bpo-34084: Fix setting an error message for the "Barry as BDFL" easter egg. (GH-8262)
    aba24ff

    @serhiy-storchaka
    Copy link
    Member

    New changeset 220afff by Serhiy Storchaka (Miss Islington (bot)) in branch '3.7':
    bpo-34084: Fix setting an error message for the "Barry as BDFL" easter egg. (GH-8262) (GH-8423)
    220afff

    @serhiy-storchaka
    Copy link
    Member

    New changeset ec729d5 by Serhiy Storchaka (Miss Islington (bot)) in branch '3.6':
    bpo-34084: Fix setting an error message for the "Barry as BDFL" easter egg. (GH-8262) (GH-8424)
    ec729d5

    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Labels
    3.7 (EOL) end of life 3.8 only security fixes easy
    Projects
    None yet
    Development

    No branches or pull requests

    4 participants