Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork34k
Closed
Description
What happened?
Re-entrantContextVar.set during_PyHamt_Eq letsContext.__eq__ replace a context whilehamt_iterator_next still walks the old HAMT nodes, leaving the iterator with freed storage and producing a use-after-free when comparing twoContext instances.
Proof of Concept:
importcontextvarsvar=contextvars.ContextVar("v")ctx1=contextvars.Context()ctx2=contextvars.Context()classBoom:def__eq__(self,other):ctx1.run(lambda:var.set(object()))returnTruectx1.run(var.set,Boom())ctx2.run(var.set,object())ctx1==ctx2
Affected Versions:
Details
| Python Version | Status | Exit Code |
|---|---|---|
Python 3.9.24+ (heads/3.9:111bbc15b26, Oct 27 2025, 21:34:13) | ASAN | 1 |
Python 3.10.19+ (heads/3.10:014261980b1, Oct 27 2025, 21:19:00) [Clang 18.1.3 (1ubuntu1)] | ASAN | 1 |
Python 3.11.14+ (heads/3.11:88f3f5b5f11, Oct 27 2025, 21:20:35) [Clang 18.1.3 (1ubuntu1)] | ASAN | 1 |
Python 3.12.12+ (heads/3.12:8cb2092bd8c, Oct 27 2025, 21:27:07) [Clang 18.1.3 (1ubuntu1)] | ASAN | 1 |
Python 3.13.9+ (heads/3.13:9c8eade20c6, Oct 27 2025, 21:28:49) [Clang 18.1.3 (1ubuntu1)] | ASAN | 1 |
Python 3.14.0+ (heads/3.14:2e216728038, Oct 27 2025, 21:30:55) [Clang 18.1.3 (1ubuntu1)] | ASAN | 1 |
Python 3.15.0a1+ (heads/main:f5394c257ce, Oct 27 2025, 21:32:37) [Clang 18.1.3 (1ubuntu1)] | ASAN | 1 |
Vulnerable Code:
Details
int_PyHamt_Eq(PyHamtObject*v,PyHamtObject*w){if (v==w) {return1; }if (v->h_count!=w->h_count) {return0; }PyHamtIteratorStateiter;hamt_iter_titer_res;hamt_find_tfind_res;PyObject*v_key;PyObject*v_val;PyObject*w_val;hamt_iterator_init(&iter,v->h_root);do {iter_res=hamt_iterator_next(&iter,&v_key,&v_val);if (iter_res==I_ITEM) {find_res=hamt_find(w,v_key,&w_val);switch (find_res) {caseF_ERROR:return-1;caseF_NOT_FOUND:return0;caseF_FOUND: {// Bug: Enter the __eq__ method which can tear down the HAMT we’re iteratingintcmp=PyObject_RichCompareBool(v_val,w_val,Py_EQ);if (cmp<0) {return-1; }if (cmp==0) {return0; } } } } }while (iter_res!=I_END);return1;}
Sanitizer Output:
Details
===================================================================1348779==ERROR: AddressSanitizer: heap-use-after-free on address 0x5060000cff98 at pc 0x5b670b71e4b3 bp 0x7ffca41ad830 sp 0x7ffca41ad828READ of size 8 at 0x5060000cff98 thread T0 #0 0x5b670b71e4b2 in _Py_TYPE /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/object.h:277:20 #1 0x5b670b71e4b2 in Py_IS_TYPE /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/object.h:302:12 #2 0x5b670b71e4b2 in hamt_iterator_next /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/hamt.c:2193:9 #3 0x5b670b71de0a in _PyHamt_Eq /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/hamt.c:2341:20 #4 0x5b670b6c8393 in context_tp_richcompare /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/context.c:565:15 #5 0x5b670b464817 in do_richcompare /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/object.c:1059:15 #6 0x5b670b464817 in PyObject_RichCompare /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/object.c:1108:21 #7 0x5b670b65e386 in _PyEval_EvalFrameDefault /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/generated_cases.c.h:4683:35 #8 0x5b670b6463bb in _PyEval_EvalFrame /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_ceval.h:121:16 #9 0x5b670b6463bb in _PyEval_Vector /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:2005:12 #10 0x5b670b6463bb in PyEval_EvalCode /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:888:21 #11 0x5b670b79d370 in run_eval_code_obj /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1365:12 #12 0x5b670b79d370 in run_mod /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1459:19 #13 0x5b670b79743c in pyrun_file /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1293:15 #14 0x5b670b79743c in _PyRun_SimpleFileObject /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:521:13 #15 0x5b670b796b05 in _PyRun_AnyFileObject /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:81:15 #16 0x5b670b7fefe5 in pymain_run_file_obj /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:410:15 #17 0x5b670b7fefe5 in pymain_run_file /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:429:15 #18 0x5b670b7fd99d in pymain_run_python /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:691:21 #19 0x5b670b7fd99d in Py_RunMain /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:772:5 #20 0x5b670b7fe451 in pymain_main /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:802:12 #21 0x5b670b7fe5c3 in Py_BytesMain /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:826:12 #22 0x779d3a22a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #23 0x779d3a22a28a in __libc_start_main csu/../csu/libc-start.c:360:3 #24 0x5b670b1ae104 in _start (/home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/python+0x1c7104) (BuildId: 5de9d2fcbcd44bfc1b0fe256566d49ad35ca1d56)0x5060000cff98 is located 24 bytes inside of 64-byte region [0x5060000cff80,0x5060000cffc0)freed by thread T0 here: #0 0x5b670b248cba in free (/home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/python+0x261cba) (BuildId: 5de9d2fcbcd44bfc1b0fe256566d49ad35ca1d56) #1 0x5b670b46ace1 in _Py_Dealloc /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/object.c:3200:5 #2 0x5b670b71edad in Py_DECREF /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/refcount.h:420:9 #3 0x5b670b71edad in hamt_tp_clear /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/hamt.c:2606:5 #4 0x5b670b71edad in hamt_tp_dealloc /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/hamt.c:2636:11 #5 0x5b670b46ace1 in _Py_Dealloc /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/object.c:3200:5 #6 0x5b670b6c71b6 in Py_DECREF /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/refcount.h:420:9 #7 0x5b670b6c71b6 in contextvar_set /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/context.c:801:5 #8 0x5b670b6c71b6 in PyContextVar_Set /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/context.c:367:9 #9 0x5b670b37ea3b in _PyObject_VectorcallTstate /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_call.h:169:11 #10 0x5b670b37ea3b in PyObject_Vectorcall /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/call.c:327:12 #11 0x5b670b665837 in _PyEval_EvalFrameDefault /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/generated_cases.c.h:1620:35 #12 0x5b670b646a14 in _PyEval_EvalFrame /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_ceval.h:121:16 #13 0x5b670b646a14 in _PyEval_Vector /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:2005:12 #14 0x5b670b6c9b13 in _PyObject_VectorcallTstate /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_call.h:169:11 #15 0x5b670b6c9b13 in context_run /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/context.c:728:29 #16 0x5b670b37ea3b in _PyObject_VectorcallTstate /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_call.h:169:11 #17 0x5b670b37ea3b in PyObject_Vectorcall /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/call.c:327:12 #18 0x5b670b665837 in _PyEval_EvalFrameDefault /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/generated_cases.c.h:1620:35 #19 0x5b670b646a14 in _PyEval_EvalFrame /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_ceval.h:121:16 #20 0x5b670b646a14 in _PyEval_Vector /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:2005:12 #21 0x5b670b4c4488 in _PyObject_VectorcallTstate /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_call.h:169:11 #22 0x5b670b4c4488 in vectorcall_unbound /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/typeobject.c:3034:12 #23 0x5b670b4c4488 in maybe_call_special_one_arg /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/typeobject.c:3176:15 #24 0x5b670b4effc0 in _PyObject_MaybeCallSpecialOneArg /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/typeobject.c:3191:12 #25 0x5b670b4effc0 in slot_tp_richcompare /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/typeobject.c:10736:21 #26 0x5b670b464817 in do_richcompare /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/object.c:1059:15 #27 0x5b670b464817 in PyObject_RichCompare /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/object.c:1108:21 #28 0x5b670b464397 in PyObject_RichCompareBool /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/object.c:1130:11 #29 0x5b670b71ddda in _PyHamt_Eq /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/hamt.c:2352:31 #30 0x5b670b6c8393 in context_tp_richcompare /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/context.c:565:15 #31 0x5b670b464817 in do_richcompare /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/object.c:1059:15 #32 0x5b670b464817 in PyObject_RichCompare /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/object.c:1108:21 #33 0x5b670b65e386 in _PyEval_EvalFrameDefault /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/generated_cases.c.h:4683:35 #34 0x5b670b6463bb in _PyEval_EvalFrame /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_ceval.h:121:16 #35 0x5b670b6463bb in _PyEval_Vector /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:2005:12 #36 0x5b670b6463bb in PyEval_EvalCode /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:888:21 #37 0x5b670b79d370 in run_eval_code_obj /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1365:12 #38 0x5b670b79d370 in run_mod /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1459:19 #39 0x5b670b79743c in pyrun_file /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1293:15 #40 0x5b670b79743c in _PyRun_SimpleFileObject /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:521:13 #41 0x5b670b796b05 in _PyRun_AnyFileObject /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:81:15 #42 0x5b670b7fefe5 in pymain_run_file_obj /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:410:15 #43 0x5b670b7fefe5 in pymain_run_file /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:429:15 #44 0x5b670b7fd99d in pymain_run_python /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:691:21 #45 0x5b670b7fd99d in Py_RunMain /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:772:5 #46 0x5b670b7fe451 in pymain_main /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:802:12 #47 0x5b670b7fe5c3 in Py_BytesMain /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:826:12 #48 0x779d3a22a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #49 0x779d3a22a28a in __libc_start_main csu/../csu/libc-start.c:360:3previously allocated by thread T0 here: #0 0x5b670b248f53 in malloc (/home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/python+0x261f53) (BuildId: 5de9d2fcbcd44bfc1b0fe256566d49ad35ca1d56) #1 0x5b670b7040f8 in _PyObject_MallocWithType /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_object_alloc.h:46:17 #2 0x5b670b7040f8 in gc_alloc /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/gc.c:2343:17 #3 0x5b670b7040f8 in _PyObject_GC_NewVar /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/gc.c:2385:25 #4 0x5b670b71fbda in hamt_node_bitmap_new /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/hamt.c:508:12 #5 0x5b670b71fbda in hamt_node_bitmap_assoc /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/hamt.c:874:38 #6 0x5b670b719f91 in _PyHamt_Assoc /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/hamt.c:2222:16 #7 0x5b670b6c7140 in contextvar_set /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/context.c:795:30 #8 0x5b670b6c7140 in PyContextVar_Set /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/context.c:367:9 #9 0x5b670b6c9b13 in _PyObject_VectorcallTstate /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_call.h:169:11 #10 0x5b670b6c9b13 in context_run /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/context.c:728:29 #11 0x5b670b37ea3b in _PyObject_VectorcallTstate /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_call.h:169:11 #12 0x5b670b37ea3b in PyObject_Vectorcall /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/call.c:327:12 #13 0x5b670b665837 in _PyEval_EvalFrameDefault /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/generated_cases.c.h:1620:35 #14 0x5b670b6463bb in _PyEval_EvalFrame /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_ceval.h:121:16 #15 0x5b670b6463bb in _PyEval_Vector /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:2005:12 #16 0x5b670b6463bb in PyEval_EvalCode /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:888:21 #17 0x5b670b79d370 in run_eval_code_obj /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1365:12 #18 0x5b670b79d370 in run_mod /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1459:19 #19 0x5b670b79743c in pyrun_file /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1293:15 #20 0x5b670b79743c in _PyRun_SimpleFileObject /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:521:13 #21 0x5b670b796b05 in _PyRun_AnyFileObject /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:81:15 #22 0x5b670b7fefe5 in pymain_run_file_obj /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:410:15 #23 0x5b670b7fefe5 in pymain_run_file /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:429:15 #24 0x5b670b7fd99d in pymain_run_python /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:691:21 #25 0x5b670b7fd99d in Py_RunMain /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:772:5 #26 0x5b670b7fe451 in pymain_main /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:802:12 #27 0x5b670b7fe5c3 in Py_BytesMain /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:826:12 #28 0x779d3a22a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #29 0x779d3a22a28a in __libc_start_main csu/../csu/libc-start.c:360:3 #30 0x5b670b1ae104 in _start (/home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/python+0x1c7104) (BuildId: 5de9d2fcbcd44bfc1b0fe256566d49ad35ca1d56)SUMMARY: AddressSanitizer: heap-use-after-free /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/object.h:277:20 in _Py_TYPEShadow bytes around the buggy address: 0x5060000cfd00: 00 00 07 fa fa fa fa fa 00 00 00 00 00 00 00 00 0x5060000cfd80: fa fa fa fa 00 00 00 00 00 00 07 fa fa fa fa fa 0x5060000cfe00: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00 0x5060000cfe80: 00 00 00 00 fa fa fa fa fd fd fd fd fd fd fd fa 0x5060000cff00: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa=>0x5060000cff80: fd fd fd[fd]fd fd fd fd fa fa fa fa fd fd fd fd 0x5060000d0000: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fd 0x5060000d0080: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa 0x5060000d0100: 00 00 00 00 00 00 00 fa fa fa fa fa fd fd fd fd 0x5060000d0180: fd fd fd fd fa fa fa fa 00 00 00 00 00 00 00 00 0x5060000d0200: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa faShadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb==1348779==ABORTING