bytearray's__setitem__ implementation currently grabs a reference to its internal buffer before calling_getbyvalue to determine the index that needs assignment._getbyvalue can call into arbitrary python code via__index__ dunders, which could alter the internal buffer and leave said reference dangling.

A prior fix for this issue ensures that bounds checking occurs after_getbyvalue is called. However, python code is capable of resizing the bytearray, resulting in limited but still broken behavior.

This patch ensures that the reference to the internal buffer is fetched only after_getbyvalue is called to prevent it from being held while any python code is run.

Issue:UAF when writing to a bytearray with an element implementing__index__ with side-effects #91153

bast0006 added2 commits

March 29, 2025 07:36

pythonGH-91153: Handle _getbytevalue potentially invalidating bytearr…

71ae212

…ay allocation during item assignment

pythonGH-91153: Add additional cases totest_mutating_index

b2f7df5

Copy link

python-cla-botbot commentedApr 10, 2025•
edited
Loading

All commit authors signed the Contributor License Agreement.

bedevere-appbot added the awaiting review label

Apr 10, 2025

Copy link

bedevere-appbot commentedApr 10, 2025

Most changes to Pythonrequire a NEWS entry. Add one using theblurb_it web app or theblurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply theskip news label instead.

bedevere-appbot mentioned this pull request

Apr 10, 2025

UAF when writing to a bytearray with an element implementing__index__ with side-effects#91153

Closed

Copy link

ContributorAuthor

bast0006 commentedApr 10, 2025•
edited
Loading

I've signed the CLA. Let me know if a NEWS entry is required. I'm not sure it is, especially since there was already a previous change that this is a fix to.

picnixz self-requested a review

May 17, 2025 11:00

picnixz reviewed

May 17, 2025

View reviewed changes

Copy link

Member

picnixz left a comment•
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Can you add a NEWS entry please? It's still worth to mention that we fixed more crashes.

Lib/test/test_bytes.py OutdatedShow resolvedHide resolved

bast0006 added2 commits

May 17, 2025 18:13

pythonGH-91153: Move mutating index bytearray test to it's own separa…

bb96c2a

…te test

pythonGH-91153: add news entry

d29422b

Copy link

ContributorAuthor

bast0006 commentedMay 17, 2025

Done

bast0006 requested a review frompicnixz

May 17, 2025 23:25

ZeroIntensity reviewed

May 18, 2025

View reviewed changes

Misc/NEWS.d/next/Core_and_Builtins/2025-05-17-18-22-12.gh-issue-91153.ioA_83.rst OutdatedShow resolvedHide resolved

Lib/test/test_bytes.pyShow resolvedHide resolved

ZeroIntensity added needs backport to 3.13

bugs and security fixes

needs backport to 3.14bugs and security fixes labels

May 18, 2025

Nit cleanup

d3d1974

bast0006 force-pushed thebast0006/gh-91153 branch from3c1de75 tod3d1974Compare

May 18, 2025 03:53

picnixz reviewed

Jun 2, 2025

View reviewed changes

Lib/test/test_bytes.py OutdatedShow resolvedHide resolved

Misc/NEWS.d/next/Core_and_Builtins/2025-05-17-20-56-05.gh-issue-91153.afgtG2.rst OutdatedShow resolvedHide resolved

Objects/bytearrayobject.c OutdatedShow resolvedHide resolved

pythonGH-91153: Fixup comments and NEWS entry

18e6597

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

ZeroIntensity approved these changes

Jun 3, 2025

View reviewed changes

Lib/test/test_bytes.py Outdated

		@@ -1889,6 +1889,39 @@ def __index__(self):
		withself.assertRaises(IndexError):
		self._testlimitedcapi.sequence_setitem(b,0,Boom())

		deftest_mutating_index_inbounds(self):
		# See gh-91153

Copy link

Member

ZeroIntensityJun 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Could you add a brief description of the issue?

Copy link

ContributorAuthor

bast0006Jun 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Done

Objects/bytearrayobject.cShow resolvedHide resolved

bedevere-appbot added awaiting core review and removed awaiting review labels

Jun 3, 2025

bast0006 force-pushed thebast0006/gh-91153 branch from5853b5c to50b7998Compare

June 3, 2025 20:53

pythonGH-91153: Add short clarifying comments to test

4b7ec9c

bast0006 force-pushed thebast0006/gh-91153 branch from50b7998 to4b7ec9cCompare

June 3, 2025 20:57

Merge branch 'main' into bast0006/pythongh-91153

9b28503

picnixz approved these changes

Jul 12, 2025

View reviewed changes

Copy link

Member

picnixz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

2 NITS and I'll merge.

Objects/bytearrayobject.c OutdatedShow resolvedHide resolved

bedevere-appbot added awaiting merge and removed awaiting core review labels

Jul 12, 2025

Apply suggestions from code review

970c1ad

picnixzenabled auto-merge (squash)

July 12, 2025 13:15

picnixz merged commit5e1e21d intopython:main

Jul 12, 2025

41 checks passed

bedevere-appbot removed the awaiting merge label

Jul 12, 2025

Copy link

miss-islington-appbot commentedJul 12, 2025

Thanks@bast0006 for the PR, and@picnixz for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

Jul 12, 2025

pythongh-91153: prevent a crash inbytearray.__setitem__(ind, ...)…

02aa323

…when `ind.__index__` has side-effects (pythonGH-132379)(cherry picked from commit5e1e21d)Co-authored-by: Bast <52266665+bast0006@users.noreply.github.com>Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Copy link

miss-islington-appbot commentedJul 12, 2025

Sorry,@bast0006 and@picnixz, I could not cleanly backport this to3.13 due to a conflict.
Please backport usingcherry_picker on command line.

cherry_picker 5e1e21dee35b8e9066692d08033bbbdb562e2c28 3.13

Copy link

bedevere-appbot commentedJul 12, 2025

GH-136581 is a backport of this pull request to the3.14 branch.

miss-islington-appbot assignedpicnixz

Jul 12, 2025

bedevere-appbot removed the needs backport to 3.14bugs and security fixes label

Jul 12, 2025

picnixz added a commit to picnixz/cpython that referenced this pull request

Jul 12, 2025

[3.13]pythongh-91153: prevent a crash in `bytearray.__setitem__(ind,…

0e827aa

… ...)` when `ind.__index__` has side-effects (pythonGH-132379)(cherry picked from commit5e1e21d)Co-authored-by: Bast <52266665+bast0006@users.noreply.github.com>Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Copy link

bedevere-appbot commentedJul 12, 2025

GH-136582 is a backport of this pull request to the3.13 branch.

bedevere-appbot removed the needs backport to 3.13bugs and security fixes label

Jul 12, 2025

picnixz added a commit that referenced this pull request

Jul 12, 2025

[3.13]gh-91153: prevent a crash inbytearray.__setitem__(ind, ...)…

360540f

… when `ind.__index__` has side-effects (GH-132379) (#136582)(cherry picked from commit5e1e21d)Co-authored-by: Bast <52266665+bast0006@users.noreply.github.com>

picnixz added a commit that referenced this pull request

Jul 12, 2025

[3.14]gh-91153: prevent a crash inbytearray.__setitem__(ind, ...)…

d5866a8

… when `ind.__index__` has side-effects (GH-132379) (#136581)gh-91153: prevent a crash in `bytearray.__setitem__(ind, ...)` when `ind.__index__` has side-effects (GH-132379)(cherry picked from commit5e1e21d)Co-authored-by: Bast <52266665+bast0006@users.noreply.github.com>Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Pranjal095 pushed a commit to Pranjal095/cpython that referenced this pull request

Jul 12, 2025

pythongh-91153: prevent a crash inbytearray.__setitem__(ind, ...)…

fc46948

…when `ind.__index__` has side-effects (python#132379)Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

picnixz added a commit to picnixz/cpython that referenced this pull request

Jul 13, 2025

pythongh-91153: prevent a crash inbytearray.__setitem__(ind, ...)…

2aa177d

…when `ind.__index__` has side-effects (python#132379)Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Labels

None yet

3 participants

Movatterモバイル変換

Uh oh!

gh-91153: Fix bytearray holding a reference to its internal buffer when calling into potentially mutating __index__ methods#132379

gh-91153: Fix bytearray holding a reference to its internal buffer when calling into potentially mutating __index__ methods#132379

Conversation

bast0006 commentedApr 10, 2025• edited by bedevere-appbotLoading Uh oh!There was an error while loading.Please reload this page.

Uh oh!

Uh oh!

python-cla-botbot commentedApr 10, 2025• editedLoading Uh oh!There was an error while loading.Please reload this page.

Uh oh!

Uh oh!

bedevere-appbot commentedApr 10, 2025

Uh oh!

bast0006 commentedApr 10, 2025• editedLoading Uh oh!There was an error while loading.Please reload this page.

Uh oh!

Uh oh!

picnixz left a comment• editedLoading Uh oh!There was an error while loading.Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

bast0006 commentedMay 17, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ZeroIntensityJun 3, 2025

Choose a reason for hiding this comment

Uh oh!

bast0006Jun 3, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

picnixz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

miss-islington-appbot commentedJul 12, 2025

Uh oh!

miss-islington-appbot commentedJul 12, 2025

Uh oh!

bedevere-appbot commentedJul 12, 2025

Uh oh!

bedevere-appbot commentedJul 12, 2025

Uh oh!

Uh oh!

gh-91153: Fix bytearray holding a reference to its internal buffer when calling into potentially mutating index methods#132379

gh-91153: Fix bytearray holding a reference to its internal buffer when calling into potentially mutating index methods#132379

bast0006 commentedApr 10, 2025•
edited by bedevere-appbot
Loading

python-cla-botbot commentedApr 10, 2025•
edited
Loading

bast0006 commentedApr 10, 2025•
edited
Loading

picnixz left a comment•
edited
Loading