Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Potential use-after-free in Py_SetPythonHome and its siblings #98978

Closed
Assignees
zooba
Labels
3.11only security fixes3.12only security fixestype-bugAn unexpected behavior, bug, or error
@filmor

Description

@filmor

Bug report

void
Py_SetPythonHome(constwchar_t*home)
{
inthas_value=home&&home[0];
PyMemAllocatorExold_alloc;
_PyMem_SetDefaultAllocator(PYMEM_DOMAIN_RAW,&old_alloc);
PyMem_RawFree(_Py_path_config.home);
if (has_value) {
_Py_path_config.home=_PyMem_RawWcsdup(home);
}
PyMem_SetAllocator(PYMEM_DOMAIN_RAW,&old_alloc);
if (has_value&&_Py_path_config.home==NULL) {
path_out_of_memory(__func__);
}
}

IfPy_SetPythonHome was called with a non-empty string and is subsequently called with an empty one, it will always runPyMem_RawFree but only actually reset the pointer in.home ifhas_value is set, so ifhome && home[0] (i.e. non-empty string).

Minimal example:

Py_SetPythonHome(L"/non-empty");Py_SetPythonHome(L"");// After this, the memory region in .home is freed but the pointer is not overwritten

Your environment

The issue occurs in our (Python.NET) test-suite:pythonnet/pythonnet#1955

  • CPython versions tested on: 3.7 - 3.11, only occurs in 3.11
  • Operating system and architecture: Windows (x86, amd64), macOS (amd64), Linux (amd64)

Additional notes

This bug was introduced in#29041, in the initial commit:a63f5d8

It's a regression, the first faulty version was 3.11.0a3.

@vstinner@zooba

Metadata

Metadata

Assignees

Labels

3.11only security fixes3.12only security fixestype-bugAn unexpected behavior, bug, or error

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions


    [8]ページ先頭

    ©2009-2025 Movatter.jp