Skip to content

heap buffer overflow #156075

Description

@chongwick

Bug report

Bug description:

import types
def f():
    raise ValueError("x")
c = f.__code__.replace(co_linetable=b'\xf0\xff\xff\xff')
g = types.FunctionType(c, {})
try:
    g()
except ValueError:
    import traceback; traceback.print_exc()```
==694==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50600006125d at pc 0x5652f25e30b4 bp 0x7ffc879b5840 sp 0x7ffc879b5838
READ of size 1 at 0x50600006125d thread T0
    #0 0x5652f25e30b3 in read_byte /src/Objects/codeobject.c:1094:12
    #1 0x5652f25e30b3 in read_varint /src/Objects/codeobject.c:1104:16
    #2 0x5652f25d3bcc in advance_with_locations /src/Objects/codeobject.c:1180:42
    #3 0x5652f25d6597 in positionsiter_next /src/Objects/codeobject.c:1460:9
    #4 0x5652f2eade74 in islice_next /src/./Modules/itertoolsmodule.c:1828:16
    #5 0x5652f2a57f57 in builtin_next /src/Python/bltinmodule.c:1550:11
    #6 0x5652f2a7d446 in _PyEval_EvalFrameDefault /src/Python/generated_cases.c.h:1174:23
    #7 0x5652f25b6888 in _PyObject_VectorcallDictTstate /src/Objects/call.c:146:15
    #8 0x5652f25bab7d in _PyObject_Call_Prepend /src/Objects/call.c:504:24
    #9 0x5652f282aab5 in slot_tp_init /src/Objects/typeobject.c:9844:15
    #10 0x5652f280cc1a in type_call /src/Objects/typeobject.c:2008:19
    #11 0x5652f25b6e73 in _PyObject_MakeTpCall /src/Objects/call.c:242:18
    #12 0x5652f2a7fc60 in _PyEval_EvalFrameDefault /src/Python/generated_cases.c.h:1509:19
    #13 0x5652f2a61751 in PyEval_EvalCode /src/Python/ceval.c:604:21
    #14 0x5652f2d0190d in run_eval_code_obj /src/Python/pythonrun.c:1412:9
    #15 0x5652f2cfc2d7 in run_mod /src/Python/pythonrun.c:1520:19
    #16 0x5652f2cfc2d7 in _PyRun_File /src/Python/pythonrun.c:1325:15
    #17 0x5652f2cfa564 in _PyRun_SimpleFile /src/Python/pythonrun.c:535:15
    #18 0x5652f2cf9bea in _PyRun_AnyFile /src/Python/pythonrun.c:80:18
    #19 0x5652f2da492c in pymain_run_file_obj /src/Modules/main.c:439:24
    #20 0x5652f2da492c in pymain_run_file /src/Modules/main.c:460:20
    #21 0x5652f2da29df in pymain_run_python /src/Modules/main.c:749:21
    #22 0x5652f2da29df in Py_RunMain /src/Modules/main.c:834:5
    #23 0x5652f2da3a4e in pymain_main /src/Modules/main.c:864:12
    #24 0x5652f2da3ccb in Py_BytesMain /src/Modules/main.c:888:12
    #25 0x7f73a036f1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #26 0x7f73a036f28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #27 0x5652f20ee0e4 in _start (/src/python+0x8a50e4) (BuildId: 3b43aba34b3fa4d8f78d45ed989d4376001e9216)

0x50600006125d is located 0 bytes after 61-byte region [0x506000061220,0x50600006125d)
allocated by thread T0 here:
    #0 0x5652f2189350 in realloc (/src/python+0x940350) (BuildId: 3b43aba34b3fa4d8f78d45ed989d4376001e9216)
    #1 0x5652f27a4db1 in _PyMem_DebugRawRealloc /src/Objects/obmalloc.c:2915:20
    #2 0x5652f259f47b in _PyBytes_Resize /src/Objects/bytesobject.c:3213:9
    #3 0x5652f258db01 in _PyBytesWriter_Finish /src/Objects/bytesobject.c:3640:21
    #4 0x5652f259511c in _PyBytes_DecodeEscape2 /src/Objects/bytesobject.c:1181:12
    #5 0x5652f25239d6 in decode_bytes_with_escapes /src/Parser/string_parser.c:213:24
    #6 0x5652f21f16f6 in _PyPegen_constant_from_string /src/Parser/action_helpers.c:1436:19
    #7 0x5652f2312cae in string_rule /src/Parser/parser.c:16414:20
    #8 0x5652f2312cae in _tmp_254_rule /src/Parser/parser.c:40960:27
    #9 0x5652f2312cae in _loop1_114_rule /src/Parser/parser.c:32565:29
    #10 0x5652f2312cae in strings_rule /src/Parser/parser.c:16466:34
    #11 0x5652f227c664 in atom_rule /src/Parser/parser.c:14862:28
    #12 0x5652f2271476 in primary_raw /src/Parser/parser.c:14500:25
    #13 0x5652f2271476 in primary_rule /src/Parser/parser.c:14298:22
    #14 0x5652f226ddff in await_primary_rule /src/Parser/parser.c:14252:28
    #15 0x5652f226b7e2 in power_rule /src/Parser/parser.c:14128:18
    #16 0x5652f2266482 in factor_rule /src/Parser/parser.c:14078:26
    #17 0x5652f2261d88 in term_raw /src/Parser/parser.c:13919:27
    #18 0x5652f225f998 in term_rule /src/Parser/parser.c:13662:22
    #19 0x5652f2258d5c in sum_raw /src/Parser/parser.c:13615:25
    #20 0x5652f2258d5c in sum_rule /src/Parser/parser.c:13494:22
    #21 0x5652f22556f8 in shift_expr_raw /src/Parser/parser.c:13454:24
    #22 0x5652f22556f8 in shift_expr_rule /src/Parser/parser.c:13314:22
    #23 0x5652f2252be9 in bitwise_and_raw /src/Parser/parser.c:13274:31
    #24 0x5652f2252be9 in bitwise_and_rule /src/Parser/parser.c:13192:22
    #25 0x5652f22507d9 in bitwise_xor_raw /src/Parser/parser.c:13152:32
    #26 0x5652f22507d9 in bitwise_xor_rule /src/Parser/parser.c:13070:22
    #27 0x5652f2248639 in bitwise_or_raw /src/Parser/parser.c:13030:32
    #28 0x5652f2248639 in bitwise_or_rule /src/Parser/parser.c:12948:22
    #29 0x5652f22b816f in comparison_rule /src/Parser/parser.c:12188:18
    #30 0x5652f22b64df in inversion_rule /src/Parser/parser.c:12139:31
    #31 0x5652f22b1d2e in conjunction_rule /src/Parser/parser.c:12016:18
    #32 0x5652f228d2de in disjunction_rule /src/Parser/parser.c:11928:18
    #33 0x5652f224146b in expression_rule /src/Parser/parser.c:11216:18
    #34 0x5652f22f2855 in kwarg_or_starred_rule /src/Parser/parser.c:17941:18
    #35 0x5652f22e780d in _gather_126_rule /src/Parser/parser.c:33345:21
    #36 0x5652f22e780d in kwargs_rule /src/Parser/parser.c:17715:18
    #37 0x5652f22dcfa0 in args_rule /src/Parser/parser.c:17658:18
    #38 0x5652f22775b2 in arguments_rule /src/Parser/parser.c:17544:18
    #39 0x5652f22a24e3 in t_primary_raw /src/Parser/parser.c:19136:18
    #40 0x5652f22a24e3 in t_primary_rule /src/Parser/parser.c:18963:22

SUMMARY: AddressSanitizer: heap-buffer-overflow /src/Objects/codeobject.c:1094:12 in read_byte
Shadow bytes around the buggy address:
  0x506000060f80: fd fd fd fd fd fd fd fa fa fa fa fa 00 00 00 00
  0x506000061000: 00 00 00 06 fa fa fa fa fd fd fd fd fd fd fd fa
  0x506000061080: fa fa fa fa 00 00 00 00 00 00 00 04 fa fa fa fa
  0x506000061100: 00 00 00 00 00 00 00 06 fa fa fa fa 00 00 00 00
  0x506000061180: 00 00 00 04 fa fa fa fa 00 00 00 00 00 00 00 00
=>0x506000061200: fa fa fa fa 00 00 00 00 00 00 00[05]fa fa fa fa
  0x506000061280: fd fd fd fd fd fd fd fa fa fa fa fa 00 00 00 00
  0x506000061300: 00 00 00 06 fa fa fa fa 00 00 00 00 00 00 00 04
  0x506000061380: fa fa fa fa 00 00 00 00 00 00 00 07 fa fa fa fa
  0x506000061400: 00 00 00 00 00 00 00 07 fa fa fa fa fd fd fd fd
  0x506000061480: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==694==ABORTING

### CPython versions tested on:

CPython main branch

### Operating systems tested on:

Linux

Metadata

Metadata

Assignees

No one assigned

    Labels

    interpreter-core(Objects, Python, Grammar, and Parser dirs)invalidtype-bugAn unexpected behavior, bug, or errortype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions