Author Preston Moore
Recipients Preston Moore
Date 2017-05-18.20:21:59
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <>
A race condition exists in shutil.copyfile() that allows the file being copied to be replaced between the time it was initially checked with stat() in this function and when it is actually open()'d and copied.  This issue can be triggered from shutil.move() (and likely other places) when attempting to move a file from one location to another where the source and destination are on different devices.  This behavior can be replicated by setting a catchpoint in gdb on calls to stat() and, after the initial call to stat in shutil.copyfile(), replacing the source file.

The attached pull request addresses this issue by storing the inode number of the source file when it is initially stat()'d and comparing this value to an inode value taken from a call to fstat() after the file is open. If these two values differ, the file has been replaced.  This is the pattern employed by coreutil's mv utility in an effort to address this issue.

This bug was found as part of an ongoing research effort into detecting and addressing bugs caused by differences in the environments in which an application may be run (the environmental issue in this place being the difficulties around correctly copying a file from one disk to another).
Date User Action Args
2017-05-18 20:22:00Preston Mooresetrecipients: + Preston Moore
2017-05-18 20:22:00Preston Mooresetmessageid: <>
2017-05-18 20:22:00Preston Moorelinkissue30400 messages
2017-05-18 20:21:59Preston Moorecreate