Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit5230244

Browse files
[3.13]gh-134100: Fix use-after-free inPyImport_ImportModuleLevelObject (GH-134117) (#134172)
gh-134100: Fix use-after-free in `PyImport_ImportModuleLevelObject` (GH-134117)(cherry picked from commit4e9005d)Co-authored-by: Nico-Posada <102486290+Nico-Posada@users.noreply.github.com>
1 parentfd6a602 commit5230244

File tree

3 files changed

+20
-1
lines changed

3 files changed

+20
-1
lines changed

‎Lib/test/test_importlib/import_/test_relative_imports.py

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,6 +223,21 @@ def test_relative_import_no_package_exists_absolute(self):
223223
self.__import__('sys', {'__package__':'','__spec__':None},
224224
level=1)
225225

226+
deftest_malicious_relative_import(self):
227+
# https://github.com/python/cpython/issues/134100
228+
# Test to make sure UAF bug with error msg doesn't come back to life
229+
importsys
230+
loooong="".ljust(0x23000,"b")
231+
name=f"a.{loooong}.c"
232+
233+
withutil.uncache(name):
234+
sys.modules[name]= {}
235+
withself.assertRaisesRegex(
236+
KeyError,
237+
r"'a\.b+' not in sys\.modules as expected"
238+
):
239+
__import__(f"{loooong}.c", {"__package__":"a"},level=1)
240+
226241

227242
(Frozen_RelativeImports,
228243
Source_RelativeImports
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Fix a use-after-free bug that occurs when an imported module isn't
2+
in:data:`sys.modules` after its initial import. Patch by Nico-Posada.

‎Python/import.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3830,15 +3830,17 @@ PyImport_ImportModuleLevelObject(PyObject *name, PyObject *globals,
38303830
}
38313831

38323832
final_mod=import_get_module(tstate,to_return);
3833-
Py_DECREF(to_return);
38343833
if (final_mod==NULL) {
38353834
if (!_PyErr_Occurred(tstate)) {
38363835
_PyErr_Format(tstate,PyExc_KeyError,
38373836
"%R not in sys.modules as expected",
38383837
to_return);
38393838
}
3839+
Py_DECREF(to_return);
38403840
gotoerror;
38413841
}
3842+
3843+
Py_DECREF(to_return);
38423844
}
38433845
}
38443846
else {

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp