Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

gh-142830: prevent some crashes when mutatingsqlite3 callbacks#143245

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged

Conversation

@picnixz
Copy link
Member

@picnixzpicnixz commentedDec 28, 2025
edited
Loading

This isnot a complete fix because there are other callbacks that need to be tested. I could technically split the PR into two but I preferred testing the conversion toPyObject * in the same PR.

@picnixz
Copy link
MemberAuthor

Actually, I'm a bit worried about backporting the change to 3.13 and 3.14 because we are now using a real heap type.

@picnixzpicnixz added 🔨 test-with-refleak-buildbotsTest PR w/ refleak buildbots; report in status section and removed needs backport to 3.13bugs and security fixes needs backport to 3.14bugs and security fixes labelsDec 28, 2025
@bedevere-bot
Copy link

🤖 New build scheduled with the buildbot fleet by@picnixz for commit4dd0652 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F143245%2Fmerge

If you want to schedule another build, you need to add the🔨 test-with-refleak-buildbots label again.

@bedevere-botbedevere-bot removed the 🔨 test-with-refleak-buildbotsTest PR w/ refleak buildbots; report in status section labelDec 28, 2025
Copy link
Member

@serhiy-storchakaserhiy-storchaka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I think this can be resolved with smaller changes.

a) Just add a refcounter to the context struct. Increment and decrement it for use, and free the struct when it is 0. This is just a field and two macros or functions.
b) Save strong references to what you need in local variables just after getting the context.

@picnixz
Copy link
MemberAuthor

picnixz commentedDec 31, 2025
edited
Loading

Mmh yes, that would aloow me to backport this and avoid burdening the GC. I didn't consider this approach as I am more used to rely on existing mechanisms.

I think I will add some macros or functions for holding the refs when needed.

@picnixz
Copy link
MemberAuthor

picnixz commentedDec 31, 2025
edited
Loading

So I've tried, but I miserably failed. Each callback creates a shared callback context that is either freed when the connection dies or when it got replaced. The problem is when I replace a callback:

  • Define cb(). This creates some conn->ctx.
  • Execute cb. During the execution, remove cb.
  • Removal of cb triggers removal of conn->ctx (it gets replaced by NULL) and conn->ctx is freed directly (deferring freeing the memory isn't possible because no one is tracking it after it's replaced in the connection's object)

Maybe I got it wrong or understood the mechanism wrongly, but relying on the GC is much more easier.

@serhiy-storchaka
Copy link
Member

When the callback is added, set its refcount to 1. If it is replaced, decrement its refcount. When the callback is called, increment its refcount (so that it doesn't disappear from under our feet), after calling it, decrement its refcount. If after any decrement it becomes 0, free it. This is very similar to how refcounts work for PyObject, but We don't need PyTypeObject and other boilerplate.

Other way is just make local strong references tocallback andmodule (if needed) and a weak reference to state (if needed) for the time of calling the callback, On this way you will only need to change the code that calls the callback, and use Python refcounts.

picnixz reacted with heart emoji

@serhiy-storchaka
Copy link
Member

I do not talk what you should do, I only describe variants which may be more laconic than the current PR.

@picnixz
Copy link
MemberAuthor

I actually tried this initial approach but I thought "why not just rely on the GC" and then went with a full-fledged PyObject. Using a PyObject definitely makes my life easier as it's not me who's responsible for that but it's also fine to use another strategy that doesn't need this overhead (consideringevery statement would require INCREF/DECREF of the entire context, it's clearly not a good idea indeed).

@picnixz
Copy link
MemberAuthor

picnixz commentedDec 31, 2025
edited
Loading

@serhiy-storchaka Thanks for the guidance! it's a bit annoying to do the manual refcounting and someone could easily forget to do it, but it's definitely better for the diff. I can also backport this PR with more confidence.

@picnixzpicnixzforce-pushed thefix/sqlite/uaf-in-progress-142830 branch from18c4f54 to2c1af7eCompareDecember 31, 2025 17:37
@picnixzpicnixzforce-pushed thefix/sqlite/uaf-in-progress-142830 branch from2c1af7e to504ef19CompareDecember 31, 2025 17:38
Copy link
Member

@serhiy-storchakaserhiy-storchaka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

LGTM. 👍

@picnixzpicnixz added needs backport to 3.13bugs and security fixes needs backport to 3.14bugs and security fixes labelsJan 1, 2026
@picnixzpicnixz merged commit7f6c16a intopython:mainJan 1, 2026
87 of 89 checks passed
@miss-islington-app
Copy link

Thanks@picnixz for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

@picnixzpicnixz deleted the fix/sqlite/uaf-in-progress-142830 branchJanuary 1, 2026 10:55
@miss-islington-app
Copy link

Sorry,@picnixz, I could not cleanly backport this to3.14 due to a conflict.
Please backport usingcherry_picker on command line.

cherry_picker 7f6c16a956d598663d8c67071c492f197045d967 3.14

@miss-islington-app
Copy link

Sorry,@picnixz, I could not cleanly backport this to3.13 due to a conflict.
Please backport usingcherry_picker on command line.

cherry_picker 7f6c16a956d598663d8c67071c492f197045d967 3.13

@picnixz
Copy link
MemberAuthor

Of course backports have conflicts -_-

picnixz added a commit to picnixz/cpython that referenced this pull requestJan 1, 2026
…callbacks (pythonGH-143245)(cherry picked from commit7f6c16a)Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
@bedevere-app
Copy link

GH-143322 is a backport of this pull request to the3.14 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.14bugs and security fixes labelJan 1, 2026
picnixz added a commit to picnixz/cpython that referenced this pull requestJan 1, 2026
…callbacks (pythonGH-143245)(cherry picked from commit7f6c16a)Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
@bedevere-app
Copy link

GH-143323 is a backport of this pull request to the3.13 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.13bugs and security fixes labelJan 1, 2026
picnixz added a commit that referenced this pull requestJan 1, 2026
picnixz added a commit that referenced this pull requestJan 1, 2026
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@serhiy-storchakaserhiy-storchakaserhiy-storchaka approved these changes

@berkerpeksagberkerpeksagAwaiting requested review from berkerpeksagberkerpeksag is a code owner

@erlend-aaslanderlend-aaslandAwaiting requested review from erlend-aaslanderlend-aasland is a code owner

@AA-TurnerAA-TurnerAwaiting requested review from AA-Turner

@emmatypingemmatypingAwaiting requested review from emmatyping

Assignees

@picnixzpicnixz

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@picnixz@bedevere-bot@serhiy-storchaka

[8]ページ先頭

©2009-2026 Movatter.jp