Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

gh-134744: Fix fcntl error handling#134748

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
vstinner merged 3 commits intopython:mainfromvstinner:fcntl
May 27, 2025
Merged

Conversation

vstinner
Copy link
Member

@vstinnervstinner commentedMay 26, 2025
edited by bedevere-appbot
Loading

@vstinner
Copy link
MemberAuthor

@serhiy-storchaka: It seems like only the main branch is affected.

I wrote a patch adding tests but it doesn't check modified error paths:

diff--gita/Lib/test/test_fcntl.pyb/Lib/test/test_fcntl.pyindexe0e6782258f..e1c72c6ab7e100644---a/Lib/test/test_fcntl.py+++b/Lib/test/test_fcntl.py@@-11,7+11,7 @@cpython_only,get_pagesize,is_apple,requires_subprocess,verbose )fromtest.support.import_helperimportimport_module-fromtest.support.os_helperimportTESTFN,unlink+fromtest.support.os_helperimportTESTFN,unlink,make_bad_fd# Skip test if no fcntl module.@@-274,6+274,13 @@deftest_fcntl_small_buffer(self):deftest_fcntl_large_buffer(self):self._check_fcntl_not_mutate_len(2024)+    @unittest.skipUnless(hasattr(fcntl,'FICLONE'),'need fcntl.FICLONE')+deftest_bad_fd(self):+# gh-134744: Test error handling+fd=make_bad_fd()+withself.assertRaises(OSError):+fcntl.ioctl(fd,fcntl.F_DUPFD,0)+if__name__=='__main__':unittest.main()diff--gita/Lib/test/test_ioctl.pyb/Lib/test/test_ioctl.pyindex3c7a58aa2bc..e2f94dbf5dd100644---a/Lib/test/test_ioctl.py+++b/Lib/test/test_ioctl.py@@-5,7+5,7 @@importthreadingimportunittestfromtestimportsupport-fromtest.supportimportthreading_helper+fromtest.supportimportos_helper,threading_helperfromtest.support.import_helperimportimport_modulefcntl=import_module('fcntl')termios=import_module('termios')@@-201,6+201,15 @@deftest_ioctl_set_window_size(self):new_winsz=struct.unpack("HHHH",result)self.assertEqual(new_winsz[:2], (20,40))+    @unittest.skipUnless(hasattr(fcntl,'FICLONE'),'need fcntl.FICLONE')+deftest_bad_fd(self):+# gh-134744: Test error handling+withopen(__file__)asfp:+fd1=fp.fileno()+fd2=os_helper.make_bad_fd()+withself.assertRaises(OSError):+fcntl.ioctl(fd1,fcntl.FICLONE,fd2)+if__name__=="__main__":unittest.main()

@sergey-miryanov
Copy link
Contributor

@vstinner It seems that on 139 and 321 lines it may leak.

@vstinner
Copy link
MemberAuthor

@vstinner It seems that on 139 and 321 lines it may leak.

Would you mind to elaborate? What leak? In which file?

@sergey-miryanov
Copy link
Contributor

Sorry, I was not clear.

Infcntlmodule.c

if (ret<0) {
if (async_err) {
PyErr_SetFromErrno(PyExc_OSError);
}
Py_DECREF(result);
returnNULL;
}
if (ptr[len]!='\0') {
PyErr_SetString(PyExc_SystemError,"buffer overflow");
returnNULL;
}
returnresult;

As you can seeresult decrefed on 134, but not on 139 lines.

if (ret<0) {
if (async_err) {
PyErr_SetFromErrno(PyExc_OSError);
}
Py_DECREF(result);
returnNULL;
}
if (ptr[len]!='\0') {
PyErr_SetString(PyExc_SystemError,"buffer overflow");
returnNULL;
}
returnresult;

Same here - it decrefed on 316, but not on 321.

serhiy-storchaka reacted with thumbs up emoji

@serhiy-storchaka
Copy link
Member

Thank you@vstinner. The code is the same in 3.14 and main, but 3.13 is not affected. It is my fail.

For testing you need to pass a large bytes object (more than 1024 bytes). Simply passb'\0' * 2048, it should fail with bad file descriptor.

Thank you@sergey-miryanov for noticing a leak.

@vstinner
Copy link
MemberAuthor

Ok, I added tests and I fixed the reference leak spotted by@sergey-miryanov.

@vstinner
Copy link
MemberAuthor

@serhiy-storchaka: Would you mind to review my fix?

@vstinner
Copy link
MemberAuthor

Thank you@vstinner. The code is the same in 3.14 and main, but 3.13 is not affected. It is my fail.

3.14 doesn't seem to be affected, the code is different.

if (ret<0) {return !async_err ?PyErr_SetFromErrno(PyExc_OSError) :NULL;        }

Copy link
Member

@serhiy-storchakaserhiy-storchaka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

LGTM. 👍

@serhiy-storchaka
Copy link
Member

Ah, so both bugs was introduced while adding a buffer overflow check.

@vstinnervstinner merged commit9300a59 intopython:mainMay 27, 2025
42 checks passed
@vstinnervstinner deleted the fcntl branchMay 27, 2025 13:09
@serhiy-storchaka
Copy link
Member

It would be nice to backport the tests.

vstinner added a commit to vstinner/cpython that referenced this pull requestMay 27, 2025
Fix also reference leak on buffer overflow.(cherry picked from commit9300a59)
@bedevere-app
Copy link

GH-134795 is a backport of this pull request to the3.14 branch.

@vstinner
Copy link
MemberAuthor

It would be nice to backport the tests.

I wrote#134795 to backport tests. I had to modify tests since Python 3.14 only supports buffer up to 1024 bytes.

vstinner added a commit that referenced this pull requestMay 27, 2025
gh-134744: Fix fcntl error handling (#134748)Fix also reference leak on buffer overflow.(cherry picked from commit9300a59)
miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestMay 27, 2025
…ythonGH-134795)pythongh-134744: Fix fcntl error handling (pythonGH-134748)Fix also reference leak on buffer overflow.(cherry picked from commit8a6a6f3)Co-authored-by: Victor Stinner <vstinner@python.org>(cherry picked from commit9300a59)
vstinner added a commit that referenced this pull requestMay 28, 2025
…134798)[3.14]gh-134744: Fix fcntl error handling (GH-134748) (GH-134795)gh-134744: Fix fcntl error handling (GH-134748)Fix also reference leak on buffer overflow.(cherry picked from commit8a6a6f3)(cherry picked from commit9300a59)Co-authored-by: Victor Stinner <vstinner@python.org>
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers

@serhiy-storchakaserhiy-storchakaserhiy-storchaka approved these changes

Assignees
No one assigned
Labels
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

3 participants
@vstinner@sergey-miryanov@serhiy-storchaka

[8]ページ先頭

©2009-2025 Movatter.jp