mirrors/cpython
mirrors/cpython
0
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2024-11-24 08:52:25 +01:00
Code Issues Releases Activity

gh-126080: fix UAF on task->task_context in task_call_step_soon due to an evil loop.__getattribute__ (#126120)

Browse Source
This commit is contained in:
Bénédikt Tran 2024-10-31 18:14:47 +01:00 committed by GitHub
parent 3275cb1953
commit 0e8665554b
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Misc/NEWS.d/next/Library/2024-10-29-10-38-28.gh-issue-126080.qKRBuo.rst Normal file
View File

@ -0,0 +1,3 @@
Fix a use-after-free crash on :class:`asyncio.Task` objects for which the
underlying event loop implements an evil :meth:`~object.__getattribute__`.
Reported by Nico-Posada. Patch by Bénédikt Tran.

6
Modules/_asynciomodule.c
View File

@ -2738,7 +2738,11 @@ task_call_step_soon(asyncio_state *state, TaskObj *task, PyObject *arg)
return -1;
}
int ret = call_soon(state, task->task_loop, cb, NULL, task->task_context);
// Beware: An evil call_soon could alter task_context.
// See: https://github.com/python/cpython/issues/126080.
PyObject *task_context = Py_NewRef(task->task_context);
int ret = call_soon(state, task->task_loop, cb, NULL, task_context);
Py_DECREF(task_context);
Py_DECREF(cb);
return ret;
}