Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork33.7k
Closed
Description
Crash report
Bug description:
Infuture_schedule_callbacks, the length of the callback list is assumed to be constant, but an evilcall_soon can make it change.
PoC:
importasynciocalled_on_fut_callback0=Falsepad=lambda: ...defevil_call_soon(*args,**kwargs):globalcalled_on_fut_callback0ifcalled_on_fut_callback0:# Called when handling fut->fut_callbacks[0]# and mutates the length fut->fut_callbacks.fut.remove_done_callback(int)fut.remove_done_callback(pad)else:called_on_fut_callback0=Truefake_event_loop=lambda: ...fake_event_loop.call_soon=evil_call_soonfake_event_loop.get_debug=lambda:False# suppress tracebackfut=asyncio.Future(loop=fake_event_loop)fut.add_done_callback(str)# sets fut->fut_callback0fut.add_done_callback(int)# sets fut->fut_callbacks[0]fut.add_done_callback(pad)# sets fut->fut_callbacks[1]fut.add_done_callback(pad)# sets fut->fut_callbacks[2]fut.set_result("boom")
CPython versions tested on:
CPython main branch
Operating systems tested on:
No response
Linked PRs
Metadata
Metadata
Assignees
Labels
Projects
Status
Done