Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

UAF onfut->fut_{callback,context}0 with evil__getattribute__ in_asynciomodule.c #125984

Closed
Assignees
picnixz
Labels
3.12only security fixes3.13bugs and security fixes3.14bugs and security fixestopic-asynciotype-crashA hard crash of the interpreter, possibly with a core dump
@picnixz

Description

@picnixz

Crash report

What happened?

importasyncioclassEvilLoop:defcall_soon(*args):# will crash before it actually gets hereprint(args)defget_debug(self):returnFalsedef__getattribute__(self,name):globaltrackerifname=="call_soon":fut.remove_done_callback(tracker)deltrackerprint("returning call_soon method after clearing callback0")returnobject.__getattribute__(self,name)classTrackDel:def__del__(self):print("deleted",self)fut=asyncio.Future(loop=EvilLoop())tracker=TrackDel()fut.add_done_callback(tracker)fut.set_result("kaboom")

Originally posted by@Nico-Posada in#125970 (comment)

Not sure I'll be able to work on it today, so anyone's free to take on it.


Traceback

deleted <__main__.TrackDel object at 0x7f4ab660a420>returning call_soon method after clearing callback0Python/context.c:534: _PyObject_GC_UNTRACK: Assertion "_PyObject_GC_IS_TRACKED(((PyObject*)(op)))" failed: object not tracked by the garbage collectorEnable tracemalloc to get the memory block allocation tracebackobject address  : 0x7f4ab64ca4b0object refcount : 0object type     : 0x9bfc60object type name: _contextvars.Contextobject repr     : <refcnt 0 at 0x7f4ab64ca4b0>Fatal Python error: _PyObject_AssertFailed: _PyObject_AssertFailedPython runtime state: initializedTypeError: EvilLoop.call_soon() got an unexpected keyword argument 'context'

Linked PRs

Metadata

Metadata

Assignees

Labels

3.12only security fixes3.13bugs and security fixes3.14bugs and security fixestopic-asynciotype-crashA hard crash of the interpreter, possibly with a core dump

Projects

Status

Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions


    [8]ページ先頭

    ©2009-2025 Movatter.jp