Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

gh-143308: fix UAF when PickleBuffer is concurrently mutated in a callback#143312

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
picnixz merged 13 commits intopython:mainfroma12k:fix-picklebuffer-uaf
Jan 3, 2026

Conversation

@a12k
Copy link
Contributor

@a12ka12k commentedDec 31, 2025•
edited by bedevere-appbot
Loading

This PR addresses a use-after-free vulnerability insave_picklebuffer inModules/_pickle.c. The issue occurred when a buffer_callback explicitly released the PickleBuffer while the pickler was still serializing it.

Validation

  • New Tests: Addedtest_release_in_callback_keepalive andtest_release_in_callback_complex_keepalive toLib/test/test_pickle.py.

Linked issue:gh-128038

@picnixzpicnixz self-requested a reviewDecember 31, 2025 18:15
@picnixzpicnixz changed the titlegh-143308: Fix Use-After-Free in _pickle by incrementing PickleBuffer exportsgh-143308: fix UAF when PickleBuffer is concurrently mutated in a callbackDec 31, 2025
picnixz
picnixz previously approved these changesDec 31, 2025
@picnixz
Copy link
Member

Just a small thing to alter and we're good (good to keep a clickable ref)

a12k reacted with rocket emoji

@picnixzpicnixz added needs backport to 3.14bugs and security fixes needs backport to 3.13bugs and security fixes labelsDec 31, 2025
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
@picnixzpicnixz dismissed theirstale reviewDecember 31, 2025 22:31

Waiting until the NEWS entry has been moved.


intrc=0;
Py_bufferkeepalive_view;// to ensure that 'view' is kept alive
if (PyObject_GetBuffer(view->obj,&keepalive_view,PyBUF_FULL_RO)!=0) {

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Could not we simply applyPyObject_GetBuffer() to thePickleBuffer object itself? We can then get rid ofPyPickleBuffer_GetBuffer().

Copy link
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Potentially! I'd want to test it.@picnixz what do you think? Since this hasn't been merged yet now would seem to be the time.

Copy link
Member

@picnixzpicnixzJan 3, 2026•
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

It should work.PyPickleBuffer_GetBuffer just returns a (borrowed) ref so it doesn't get any buffer on it. I think it should work so feel free to check!

a12k reacted with thumbs up emoji
Copy link
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

This worked great, thanks for the suggestion@serhiy-storchaka.@picnixz The change was a little more involved than expected, but by doing this I was able to remove a redundant view, update all theview-> calls, and the exit: label. All tests pass and confirmed that the patch still holds.

view->len);
if (view.readonly) {
rc=_save_bytes_data(st,self,obj, (constchar*)view.buf,
view.len);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Can you vertically align 'view.len' with 'st'? (likewise, some lines below)

a12k reacted with thumbs up emoji
Comment on lines 2645 to 2646
"PickleBuffer can not be pickled when "
"pointing to a non-contiguous buffer");
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Out of curiosity, but do we have a test for this?

a12k reacted with eyes emoji
Copy link
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Neither of the tests added test for non-contiguous, but should be straightforward to add a test against a buffer with strides...

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I just wanted to be sure that this branch was covered by existing tests or by other tests. We can increase the coverage in a follow-up PR.

a12k reacted with thumbs up emoji
Copy link
Member

@serhiy-storchakaserhiy-storchaka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

LGTM. 👍

In the following issue we can removePyPickleBuffer_GetBuffer() andPyPickleBuffer_Release().

@picnixzpicnixz merged commit6c53af1 intopython:mainJan 3, 2026
46 checks passed
@miss-islington-app
Copy link

Thanks@a12k for the PR, and@picnixz for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestJan 3, 2026
… a callback (pythonGH-143312)(cherry picked from commit6c53af1)Co-authored-by: Aaron Wieczorek <aaronw@fastmail.com>Co-authored-by: Aaron Wieczorek <woz@Aarons-MacBook-Pro.local>Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestJan 3, 2026
… a callback (pythonGH-143312)(cherry picked from commit6c53af1)Co-authored-by: Aaron Wieczorek <aaronw@fastmail.com>Co-authored-by: Aaron Wieczorek <woz@Aarons-MacBook-Pro.local>Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
@bedevere-app
Copy link

GH-143396 is a backport of this pull request to the3.14 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.14bugs and security fixes labelJan 3, 2026
@bedevere-app
Copy link

GH-143397 is a backport of this pull request to the3.13 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.13bugs and security fixes labelJan 3, 2026
picnixz added a commit that referenced this pull requestJan 3, 2026
…n a callback (GH-143312) (#143396)gh-143308: fix UAF when PickleBuffer is concurrently mutated in a callback (GH-143312)(cherry picked from commit6c53af1)---------------Co-authored-by: Aaron Wieczorek <aaronw@fastmail.com>Co-authored-by: Aaron Wieczorek <woz@Aarons-MacBook-Pro.local>Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
picnixz added a commit that referenced this pull requestJan 3, 2026
…n a callback (GH-143312) (#143397)gh-143308: fix UAF when PickleBuffer is concurrently mutated in a callback (GH-143312)(cherry picked from commit6c53af1)---------------Co-authored-by: Aaron Wieczorek <aaronw@fastmail.com>Co-authored-by: Aaron Wieczorek <woz@Aarons-MacBook-Pro.local>Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@picnixzpicnixzpicnixz approved these changes

@serhiy-storchakaserhiy-storchakaserhiy-storchaka approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@a12k@picnixz@serhiy-storchaka
[8]ページ先頭
©2009-2026 Movatter.jp