Commitce88c7e

committed

Fix UAF in _collections Counter update fast path

1 parentb8d3fdd commitce88c7eCopy full SHA for ce88c7e

File tree

+21

-0

lines changed

+21

-0

lines changed

Lines changed: 16 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -2135,6 +2135,22 @@ def test_basics(self):`
`2135`	`2135`	`self.assertEqual(c.setdefault('e',5),5)`
`2136`	`2136`	`self.assertEqual(c['e'],5)`
`2137`	`2137`
	`2138`	`+deftest_update_reentrant_add_clears_counter(self):`
	`2139`	`+c=Counter()`
	`2140`	`+key=object()`
	`2141`	`+`
	`2142`	`+classEvil(int):`
	`2143`	`+def__new__(cls):`
	`2144`	`+returnint.__new__(cls,0)`
	`2145`	`+`
	`2146`	`+def__add__(self,other):`
	`2147`	`+c.clear()`
	`2148`	`+returnNotImplemented`
	`2149`	`+`
	`2150`	`+c[key]=Evil()`
	`2151`	`+c.update([key])`
	`2152`	`+self.assertEqual(c[key],1)`
	`2153`	`+`
`2138`	`2154`	`deftest_init(self):`
`2139`	`2155`	`self.assertEqual(list(Counter(self=42).items()), [('self',42)])`
`2140`	`2156`	`self.assertEqual(list(Counter(iterable=42).items()), [('iterable',42)])`

Lines changed: 5 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -2577,7 +2577,12 @@ _collections__count_elements_impl(PyObject module, PyObject mapping,`
`2577`	`2577`	`if (_PyDict_SetItem_KnownHash(mapping,key,one,hash)<0)`
`2578`	`2578`	`gotodone;`
`2579`	`2579`	`}else {`
	`2580`	`+/* oldval is a borrowed reference. Keep it alive across`
	`2581`	`+ PyNumber_Add(), which can execute arbitrary user code and`
	`2582`	`+ mutate (or even clear) the underlying dict. */`
	`2583`	`+Py_INCREF(oldval);`
`2580`	`2584`	`newval=PyNumber_Add(oldval,one);`
	`2585`	`+Py_DECREF(oldval);`
`2581`	`2586`	`if (newval==NULL)`
`2582`	`2587`	`gotodone;`
`2583`	`2588`	`if (_PyDict_SetItem_KnownHash(mapping,key,newval,hash)<0)`

Comments

(0)