Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TextIOWrapper.reconfigure() crashes if encoding is not string or None #111942

Closed
serhiy-storchaka opened this issue Nov 10, 2023 · 2 comments
Closed
Assignees
Labels
topic-IO type-crash A hard crash of the interpreter, possibly with a core dump

Comments

@serhiy-storchaka
Copy link
Member

serhiy-storchaka commented Nov 10, 2023

Crash report

What happened?

Unlike to TextIOWrapper constructor, TextIOWrapper.reconfigure() does not check that the encoding argument is actually None or string. If it is not None, it calls _PyUnicode_EqualToASCIIString that only works with strings and crashes in debug build. There may be other similar errors in other arguments.

>>> import sys
>>> sys.stdout.reconfigure(encoding=42)
Objects/unicodeobject.c:552: _PyUnicode_CheckConsistency: Assertion failed: PyType_HasFeature((Py_TYPE(((PyObject*)((op))))), ((1UL << 28)))
Enable tracemalloc to get the memory block allocation traceback

object address  : 0x55a2e3147ca8
object refcount : 4294967295
object type     : 0x55a2e3119f00
object type name: int
object repr     : 42

Fatal Python error: _PyObject_AssertFailed: _PyObject_AssertFailed
Python runtime state: initialized

Current thread 0x00007fc99ee43740 (most recent call first):
  File "<stdin>-1", line 1 in <module>
Aborted (core dumped)

CPython versions tested on:

3.10, 3.11, 3.12

Operating systems tested on:

No response

Output from running 'python -VV' on the command line:

No response

Linked PRs

@serhiy-storchaka serhiy-storchaka added topic-IO type-crash A hard crash of the interpreter, possibly with a core dump labels Nov 10, 2023
@serhiy-storchaka serhiy-storchaka self-assigned this Nov 10, 2023
serhiy-storchaka added a commit to serhiy-storchaka/cpython that referenced this issue Nov 10, 2023
* Fix crash when encoding is not string or None.
* Fix crash when both line_buffering and write_through raise exception
  when converted ti int.
* Add a number of tests for constructor and reconfigure() method
  with invalid arguments.
serhiy-storchaka added a commit that referenced this issue Nov 14, 2023
* Fix crash when encoding is not string or None.
* Fix crash when both line_buffering and write_through raise exception
  when converted ti int.
* Add a number of tests for constructor and reconfigure() method
  with invalid arguments.
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Nov 14, 2023
…-111976)

* Fix crash when encoding is not string or None.
* Fix crash when both line_buffering and write_through raise exception
  when converted ti int.
* Add a number of tests for constructor and reconfigure() method
  with invalid arguments.
(cherry picked from commit ee06fff)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Nov 14, 2023
…-111976)

* Fix crash when encoding is not string or None.
* Fix crash when both line_buffering and write_through raise exception
  when converted ti int.
* Add a number of tests for constructor and reconfigure() method
  with invalid arguments.
(cherry picked from commit ee06fff)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
serhiy-storchaka added a commit that referenced this issue Nov 14, 2023
…) (GH-112058)

* Fix crash when encoding is not string or None.
* Fix crash when both line_buffering and write_through raise exception
  when converted ti int.
* Add a number of tests for constructor and reconfigure() method
  with invalid arguments.

(cherry picked from commit ee06fff)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
serhiy-storchaka added a commit to serhiy-storchaka/cpython that referenced this issue Nov 14, 2023
In non-debug more the check for the "errors" argument is skipped,
and then PyUnicode_AsUTF8() can fail, but its result was not checked.
serhiy-storchaka added a commit to serhiy-storchaka/cpython that referenced this issue Nov 14, 2023
In non-debug more the check for the "errors" argument is skipped,
and then PyUnicode_AsUTF8() can fail, but its result was not checked.
@serhiy-storchaka
Copy link
Member Author

Weird. The address sanitizer tests were passed in main and 3.12, but failed in 3.11. And I now can reproduce the failure locally in main.

The newly added tests exposed a bug in the TextIOWrapper constructor when pass a non-encodable "errors" argument.

vstinner added a commit to vstinner/cpython that referenced this issue Nov 14, 2023
The error handler is not tested in the _io extension. It's only
tested if Python is built in debug mode (Py_DEBUG) or if the Python
Development Mode (-X dev) is enabled.
vstinner added a commit that referenced this issue Nov 14, 2023
In non-debug more the check for the "errors" argument is skipped,
and then PyUnicode_AsUTF8() can fail, but its result was not checked.

Co-authored-by: Victor Stinner <vstinner@python.org>
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Nov 14, 2023
…thonGH-112061)

In non-debug more the check for the "errors" argument is skipped,
and then PyUnicode_AsUTF8() can fail, but its result was not checked.

(cherry picked from commit 9302f05)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Victor Stinner <vstinner@python.org>
vstinner pushed a commit to vstinner/cpython that referenced this issue Nov 14, 2023
…thon#112061)

In non-debug more the check for the "errors" argument is skipped,
and then PyUnicode_AsUTF8() can fail, but its result was not checked.

Co-authored-by: Victor Stinner <vstinner@python.org>
(cherry picked from commit 9302f05)
vstinner pushed a commit to vstinner/cpython that referenced this issue Nov 14, 2023
…thon#112061)

In non-debug more the check for the "errors" argument is skipped,
and then PyUnicode_AsUTF8() can fail, but its result was not checked.

Co-authored-by: Victor Stinner <vstinner@python.org>
(cherry picked from commit 9302f05)
serhiy-storchaka added a commit that referenced this issue Nov 15, 2023
…H-112061) (GH-112089)

In non-debug more the check for the "errors" argument is skipped,
and then PyUnicode_AsUTF8() can fail, but its result was not checked.

Co-authored-by: Victor Stinner <vstinner@python.org>
(cherry picked from commit 9302f05)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
serhiy-storchaka added a commit to miss-islington/cpython that referenced this issue Nov 15, 2023
…tor (pythonGH-112061) (pythonGH-112089)

In non-debug more the check for the "errors" argument is skipped,
and then PyUnicode_AsUTF8() can fail, but its result was not checked.

Co-authored-by: Victor Stinner <vstinner@python.org>
(cherry picked from commit 9302f05)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
serhiy-storchaka added a commit that referenced this issue Nov 15, 2023
…) (GH-112059)

* Fix crash when encoding is not string or None.
* Fix crash when both line_buffering and write_through raise exception
  when converted ti int.
* Add a number of tests for constructor and reconfigure() method
  with invalid arguments.

(cherry picked from commit ee06fff)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@vstinner
Copy link
Member

Nice thanks, thanks.

aisk pushed a commit to aisk/cpython that referenced this issue Feb 11, 2024
…-111976)

* Fix crash when encoding is not string or None.
* Fix crash when both line_buffering and write_through raise exception
  when converted ti int.
* Add a number of tests for constructor and reconfigure() method
  with invalid arguments.
aisk pushed a commit to aisk/cpython that referenced this issue Feb 11, 2024
…thon#112061)

In non-debug more the check for the "errors" argument is skipped,
and then PyUnicode_AsUTF8() can fail, but its result was not checked.

Co-authored-by: Victor Stinner <vstinner@python.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
topic-IO type-crash A hard crash of the interpreter, possibly with a core dump
Projects
None yet
Development

No branches or pull requests

2 participants