NotificationsYou must be signed in to change notification settings
Fork32.2k
Star67.7k

[3.11] gh-120384: gh-120298: Fix array-out-of-bounds & use after free`list`#121345

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Draft

gpshead wants to merge2 commits intopython:3.11

base:3.11

Choose a base branch

fromgpshead:backport-120384-3.11

Draft

[3.11] gh-120384: gh-120298: Fix array-out-of-bounds & use after free`list`#121345

gpshead wants to merge2 commits intopython:3.11fromgpshead:backport-120384-3.11

Conversation

Copy link

Member

gpshead commentedJul 3, 2024•
edited
Loading

gh-120384: Fix array-out-of-bounds crash inlist_ass_subscript (GH-120442) (cherry picked from commit8334a1b in the 3.12 branch)

gh-120298: Fix use after free inlist_richcompare.

pythongh-120384: Fix array-out-of-bounds crash inlist_ass_subscript(

6d1ab20

pythonGH-120442) (python#120825)pythongh-120384: Fix array-out-of-bounds crash in `list_ass_subscript` (pythonGH-120442)(cherry picked from commit8334a1b)Co-authored-by: Nikita Sobolev <mail@sobolevn.me>

bedevere-appbot mentioned this pull request

Jul 3, 2024

Array out of bounds assignment in list_ass_subscript#120384

Closed

Backportpythongh-120298list_richcompare use after free

391eb41

This backports the fix topython#120298.commit idb884536

gpshead changed the title~~[3.11] gh-120384: Fix array-out-of-bounds crash inlist_ass_subscript~~[3.11] gh-120384: gh-120298: Fix array-out-of-bounds & use after freelist

Jul 3, 2024

Copy link

MemberAuthor

gpshead commentedJul 3, 2024

For consideration as a security related backport. To trigger these, people already need the ability to run arbitrary Python code. So we don't consider this a vulnerability given the existing capabilities. But it could make the life of some projects built on top of Python a little better.

Such projects are already on undefined behavior grounds if they consider anything executing Python bytecode to not be able to escape that to begin with. Because CPython does not guarantee any such thing.