New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
use-after-free in list object function #82791
Comments
Code 1 : static PyObject *
list_index_impl(PyListObject *self, PyObject *value, Py_ssize_t start,
Py_ssize_t stop)
// ...
for (i = start; i < stop && i < Py_SIZE(self); i++) {
int cmp = PyObject_RichCompareBool(self->ob_item[i], value, Py_EQ); <= self->ob_item[i] can uaf .. PoC : class rewrite_list_eq(list) :
def __eq__(self,other) :
str(other) # <== that will call the object recall function tp_repr and call it ..
return NotImplemented
class poc() :
def __eq__(self,other) :
list1.clear()
return NotImplemented
list1 = [ poc() ]
list1.index(list1) # list_index_impl() -> PyObject_RichCompareBool() Crash Report : (gdb) run ../py_poc/list_poc_3.py Program received signal SIGSEGV, Segmentation fault. ===== Code 2 : static PyObject *
list_count(PyListObject *self, PyObject *value)
{
Py_ssize_t count = 0;
Py_ssize_t i;
for (i = 0; i < Py_SIZE(self); i++) {
int cmp = PyObject_RichCompareBool(self->ob_item[i], value, Py_EQ); // <= PoC : class rewrite_list_eq(list) :
def __eq__(self,other) :
str(other)
return NotImplemented
class poc() :
def __eq__(self,other) :
list1.clear()
return NotImplemented
list1 = rewrite_list_eq([ poc() ])
list1.count(list1) # list_count() -> PyObject_RichCompareBool() Crash Report : (gdb) run ../py_poc/list_poc_4.py Program received signal SIGSEGV, Segmentation fault. === Code 3 : static PyObject *
list_remove(PyListObject *self, PyObject *value)
/*[clinic end generated code: output=f087e1951a5e30d1 input=2dc2ba5bb2fb1f82]*/
{
Py_ssize_t i;
for (i = 0; i < Py_SIZE(self); i++) {
Py_INCREF(self->ob_item[i]);
int cmp = PyObject_RichCompareBool(self->ob_item[i], value, Py_EQ); PoC : class rewrite_list_eq(list) :
def __eq__(self,other) :
str(other)
return NotImplemented
class poc() :
def __eq__(self,other) :
list1.clear()
return NotImplemented
list1 = rewrite_list_eq([ poc() ])
list1.remove(list1) # list_count() -> PyObject_RichCompareBool() Crash Report : (gdb) run ../py_poc/list_poc_5.py Program received signal SIGSEGV, Segmentation fault. |
I have created a patch to fix these crashes. Please consider taking a look. |
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
bugs.python.org fields:
The text was updated successfully, but these errors were encountered: