Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork32.3k
gh-91153: Fix bytearray holding a reference to its internal buffer when calling into potentially mutating __index__ methods#132379
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Merged
+42 −2
Merged
Changes fromall commits
Commits
Show all changes
9 commits Select commitHold shift + click to select a range
71ae212 GH-91153: Handle _getbytevalue potentially invalidating bytearray all…
bast0006b2f7df5 GH-91153: Add additional cases to `test_mutating_index`
bast0006bb96c2a GH-91153: Move mutating index bytearray test to it's own separate test
bast0006d29422b GH-91153: add news entry
bast0006d3d1974 Nit cleanup
bast000618e6597 GH-91153: Fixup comments and NEWS entry
bast00064b7ec9c GH-91153: Add short clarifying comments to test
bast00069b28503 Merge branch 'main' into bast0006/gh-91153
picnixz970c1ad Apply suggestions from code review
picnixzFile filter
Filter by extension
Conversations
Failed to load comments.
Loading
Uh oh!
There was an error while loading.Please reload this page.
Jump to
Jump to file
Failed to load files.
Loading
Uh oh!
There was an error while loading.Please reload this page.
Diff view
Diff view
There are no files selected for viewing
35 changes: 35 additions & 0 deletionsLib/test/test_bytes.py
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1899,6 +1899,8 @@ def test_repeat_after_setslice(self): | ||
| self.assertEqual(b3, b'xcxcxc') | ||
| def test_mutating_index(self): | ||
| # bytearray slice assignment can call into python code | ||
| # that reallocates the internal buffer | ||
| # See gh-91153 | ||
| class Boom: | ||
| @@ -1916,6 +1918,39 @@ def __index__(self): | ||
| with self.assertRaises(IndexError): | ||
| self._testlimitedcapi.sequence_setitem(b, 0, Boom()) | ||
| def test_mutating_index_inbounds(self): | ||
bast0006 marked this conversation as resolved. Show resolvedHide resolvedUh oh!There was an error while loading.Please reload this page. | ||
| # gh-91153 continued | ||
| # Ensure buffer is not broken even if length is correct | ||
| class MutatesOnIndex: | ||
| def __init__(self): | ||
| self.ba = bytearray(0x180) | ||
| def __index__(self): | ||
| self.ba.clear() | ||
| self.new_ba = bytearray(0x180) # to catch out-of-bounds writes | ||
| self.ba.extend([0] * 0x180) # to check bounds checks | ||
| return 0 | ||
| with self.subTest("skip_bounds_safety"): | ||
| instance = MutatesOnIndex() | ||
| instance.ba[instance] = ord("?") | ||
| self.assertEqual(instance.ba[0], ord("?"), "Assigned bytearray not altered") | ||
| self.assertEqual(instance.new_ba, bytearray(0x180), "Wrong object altered") | ||
| with self.subTest("skip_bounds_safety_capi"): | ||
| instance = MutatesOnIndex() | ||
| instance.ba[instance] = ord("?") | ||
| self._testlimitedcapi.sequence_setitem(instance.ba, instance, ord("?")) | ||
| self.assertEqual(instance.ba[0], ord("?"), "Assigned bytearray not altered") | ||
| self.assertEqual(instance.new_ba, bytearray(0x180), "Wrong object altered") | ||
| with self.subTest("skip_bounds_safety_slice"): | ||
| instance = MutatesOnIndex() | ||
| instance.ba[instance:1] = [ord("?")] | ||
| self.assertEqual(instance.ba[0], ord("?"), "Assigned bytearray not altered") | ||
| self.assertEqual(instance.new_ba, bytearray(0x180), "Wrong object altered") | ||
| class AssortedBytesTest(unittest.TestCase): | ||
| # | ||
1 change: 1 addition & 0 deletionsMisc/NEWS.d/next/Core_and_Builtins/2025-05-17-20-56-05.gh-issue-91153.afgtG2.rst
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| Fix a crash when a :class:`bytearray` is concurrently mutated during item assignment. |
8 changes: 6 additions & 2 deletionsObjects/bytearrayobject.c
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -709,7 +709,9 @@ bytearray_ass_subscript_lock_held(PyObject *op, PyObject *index, PyObject *value | ||
| _Py_CRITICAL_SECTION_ASSERT_OBJECT_LOCKED(op); | ||
| PyByteArrayObject *self = _PyByteArray_CAST(op); | ||
| Py_ssize_t start, stop, step, slicelen; | ||
| // Do not store a reference to the internal buffer since | ||
| // index.__index__() or _getbytevalue() may alter 'self'. | ||
| // See https://github.com/python/cpython/issues/91153. | ||
picnixz marked this conversation as resolved. Show resolvedHide resolvedUh oh!There was an error while loading.Please reload this page. | ||
| if (_PyIndex_Check(index)) { | ||
| Py_ssize_t i = PyNumber_AsSsize_t(index, PyExc_IndexError); | ||
| @@ -744,7 +746,7 @@ bytearray_ass_subscript_lock_held(PyObject *op, PyObject *index, PyObject *value | ||
| } | ||
| else { | ||
| assert(0 <= ival && ival < 256); | ||
| PyByteArray_AS_STRING(self)[i] = (char)ival; | ||
| return 0; | ||
| } | ||
| } | ||
| @@ -805,6 +807,7 @@ bytearray_ass_subscript_lock_held(PyObject *op, PyObject *index, PyObject *value | ||
| /* Delete slice */ | ||
| size_t cur; | ||
| Py_ssize_t i; | ||
| char *buf = PyByteArray_AS_STRING(self); | ||
| if (!_canresize(self)) | ||
| return -1; | ||
| @@ -845,6 +848,7 @@ bytearray_ass_subscript_lock_held(PyObject *op, PyObject *index, PyObject *value | ||
| /* Assign slice */ | ||
| Py_ssize_t i; | ||
| size_t cur; | ||
| char *buf = PyByteArray_AS_STRING(self); | ||
| if (needed != slicelen) { | ||
| PyErr_Format(PyExc_ValueError, | ||
Oops, something went wrong.
Uh oh!
There was an error while loading.Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.