Skip to content

gh-92888: Fix memoryview bad __index__ use after free #92946

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Fidget-Spinner merged 12 commits into from
Jun 17, 2022
Merged

gh-92888: Fix memoryview bad __index__ use after free #92946

Changes from 1 commit
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
73ffb29
Fix memoryview bad `__index__` use after free
Fidget-Spinner May 19, 2022
3581de7
📜🤖 Added by blurb_it.
blurb-it[bot] May 19, 2022
43c66d6
stylistic nits
Fidget-Spinner May 19, 2022
18b921f
Merge branch 'fix_memoryview_auf' of https://github.com/Fidget-Spinne…
Fidget-Spinner May 20, 2022
2f3c04f
Fix whitespace
Fidget-Spinner May 21, 2022
a250b02
Use more comprehensive tests by Serhiy
Fidget-Spinner May 23, 2022
c818990
Add more tests by Serhiy
Fidget-Spinner May 23, 2022
42a706c
Fix newline
Fidget-Spinner May 23, 2022
b650764
Fix for tuple index
Fidget-Spinner May 23, 2022
47bd91f
Address review
Fidget-Spinner May 23, 2022
6890713
Address Victor's review
Fidget-Spinner May 29, 2022
d3edf74
re-add ba=None
Fidget-Spinner May 30, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Fix newline
  • Loading branch information
@Fidget-Spinner
Fidget-Spinner committed May 23, 2022
commit 42a706c9597a7e7b06cc4380fef5a742053e083f
3 changes: 2 additions & 1 deletion Misc/NEWS.d/next/Security/2022-05-19-08-53-07.gh-issue-92888.TLtR9W.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,2 @@
Fix ``memoryview`` use after free when accessing the backing buffer in certain cases.
Fix ``memoryview`` use after free when accessing the backing buffer in certain cases.
Copy link
Copy Markdown
Member

@vstinner vstinner May 23, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I propose to mention more explicitly that the protection is about released views:

If a memoryview is released while getting or setting an item, raise an exception.
For example, converting an object to an index can execute arbitrary Python
code which can indirectly release the memoryview.

Copy link
Copy Markdown
Member

@serhiy-storchaka serhiy-storchaka May 25, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not always an exception is raised.

The bug was in reading or wring the freed memory. Now it is prevented -- you either get an exception or free the memory after reading. @Fidget-Spinner's description is more correct.

I am going to address such inconsistency in a separate issue.