Commit2b466c4

and

authored

gh-112127: Fix possible use-after-free in atexit.unregister() (GH-114092)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

1 parent49627dc commit2b466c4Copy full SHA for 2b466c4

File tree

+18

-1

lines changed

+18

-1

lines changed

Lines changed: 13 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -135,6 +135,19 @@ def func():`
`135`	`135`	`finally:`
`136`	`136`	`atexit.unregister(func)`
`137`	`137`
	`138`	`+deftest_eq_unregister_clear(self):`
	`139`	`+# Issue #112127: callback's __eq__ may call unregister or _clear`
	`140`	`+classEvil:`
	`141`	`+def__eq__(self,other):`
	`142`	`+action(other)`
	`143`	`+returnNotImplemented`
	`144`	`+`
	`145`	`+foractioninatexit.unregister,lambdao:atexit._clear():`
	`146`	`+withself.subTest(action=action):`
	`147`	`+atexit.register(lambda:None)`
	`148`	`+atexit.unregister(Evil())`
	`149`	`+atexit._clear()`
	`150`	`+`
`138`	`151`
`139`	`152`	`if__name__=="__main__":`
`140`	`153`	`unittest.main()`

Lines changed: 1 addition & 0 deletions

Lines changed: 2 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	+Fix possible use-after-free in:func:`atexit.unregister` when the callback
	`2`	`+is unregistered during comparison.`

Lines changed: 2 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -257,10 +257,11 @@ static int`
`257`	`257`	`atexit_unregister_locked(PyObjectcallbacks,PyObjectfunc)`
`258`	`258`	`{`
`259`	`259`	`for (Py_ssize_ti=0;i<PyList_GET_SIZE(callbacks);++i) {`
`260`		`-PyObject*tuple=PyList_GET_ITEM(callbacks,i);`
	`260`	`+PyObject*tuple=Py_NewRef(PyList_GET_ITEM(callbacks,i));`
`261`	`261`	`assert(PyTuple_CheckExact(tuple));`
`262`	`262`	`PyObject*to_compare=PyTuple_GET_ITEM(tuple,0);`
`263`	`263`	`intcmp=PyObject_RichCompareBool(func,to_compare,Py_EQ);`
	`264`	`+Py_DECREF(tuple);`
`264`	`265`	`if (cmp<0)`
`265`	`266`	`{`
`266`	`267`	`return-1;`

Comments

(0)