Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit8d51ed6

Browse files
[3.14]gh-134100: Fix use-after-free inPyImport_ImportModuleLevelObject (GH-134117) (#134171)
gh-134100: Fix use-after-free in `PyImport_ImportModuleLevelObject` (GH-134117)(cherry picked from commit4e9005d)Co-authored-by: Nico-Posada <102486290+Nico-Posada@users.noreply.github.com>
1 parentbf39dec commit8d51ed6

File tree

3 files changed

+20
-1
lines changed

3 files changed

+20
-1
lines changed

‎Lib/test/test_importlib/import_/test_relative_imports.py

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,6 +223,21 @@ def test_relative_import_no_package_exists_absolute(self):
223223
self.__import__('sys', {'__package__':'','__spec__':None},
224224
level=1)
225225

226+
deftest_malicious_relative_import(self):
227+
# https://github.com/python/cpython/issues/134100
228+
# Test to make sure UAF bug with error msg doesn't come back to life
229+
importsys
230+
loooong="".ljust(0x23000,"b")
231+
name=f"a.{loooong}.c"
232+
233+
withutil.uncache(name):
234+
sys.modules[name]= {}
235+
withself.assertRaisesRegex(
236+
KeyError,
237+
r"'a\.b+' not in sys\.modules as expected"
238+
):
239+
__import__(f"{loooong}.c", {"__package__":"a"},level=1)
240+
226241

227242
(Frozen_RelativeImports,
228243
Source_RelativeImports
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Fix a use-after-free bug that occurs when an imported module isn't
2+
in:data:`sys.modules` after its initial import. Patch by Nico-Posada.

‎Python/import.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3852,15 +3852,17 @@ PyImport_ImportModuleLevelObject(PyObject *name, PyObject *globals,
38523852
}
38533853

38543854
final_mod=import_get_module(tstate,to_return);
3855-
Py_DECREF(to_return);
38563855
if (final_mod==NULL) {
38573856
if (!_PyErr_Occurred(tstate)) {
38583857
_PyErr_Format(tstate,PyExc_KeyError,
38593858
"%R not in sys.modules as expected",
38603859
to_return);
38613860
}
3861+
Py_DECREF(to_return);
38623862
gotoerror;
38633863
}
3864+
3865+
Py_DECREF(to_return);
38643866
}
38653867
}
38663868
else {

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp