gh-118331: Fix a couple of issues when list allocation fails (#130811) · python/cpython@d7bb7c7 · GitHub
Skip to content

Commit d7bb7c7

Browse files
authored
gh-118331: Fix a couple of issues when list allocation fails (#130811)
* Fix use after free in list objects Set the items pointer in the list object to NULL after the items array is freed during list deallocation. Otherwise, we can end up with a list object added to the free list that contains a pointer to an already-freed items array. * Mark `_PyList_FromStackRefStealOnSuccess` as escaping I think technically it's not escaping, because the only object that can be decrefed if allocation fails is an exact list, which cannot execute arbitrary code when it is destroyed. However, this seems less intrusive than trying to special cases objects in the assert in `_Py_Dealloc` that checks for non-null stackpointers and shouldn't matter for performance.
1 parent 2904ec2 commit d7bb7c7

7 files changed

Lines changed: 26 additions & 4 deletions

File tree

Include/internal/pycore_opcode_metadata.h

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Include/internal/pycore_uop_metadata.h

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Lib/test/test_list.py

Lines changed: 19 additions & 1 deletion

Objects/listobject.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -533,6 +533,7 @@ list_dealloc(PyObject *self)
533533
Py_XDECREF(op->ob_item[i]);
534534
}
535535
free_list_items(op->ob_item, false);
536+
op->ob_item = NULL;
536537
}
537538
if (PyList_CheckExact(op)) {
538539
_Py_FREELIST_FREE(lists, op, PyObject_GC_Del);

Python/executor_cases.c.h

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Python/generated_cases.c.h

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Tools/cases_generator/analyzer.py

Lines changed: 0 additions & 1 deletion

0 commit comments

Comments
 (0)