Bug report
Bug description:
import json
class A:
pass
class B:
pass
lst = [A()]
def default(o):
if isinstance(o, A):
lst.clear() # drop the list's (last) reference to the A instance
return B() # B is also unknown -> encoded via default again
raise TypeError("cannot encode B") # make encoding of B fail (rv != 0)
try:
json.dumps(lst, default=default, check_circular=False)
except Exception as exc:
print("exception:", type(exc).__name__, exc)
print("OK p_json_default_uaf")=================================================================
==274==ERROR: AddressSanitizer: heap-use-after-free on address 0x51300002baa8 at pc 0xaaaad8291aa8 bp 0xfffff2433e20 sp 0xfffff2433e10
READ of size 8 at 0x51300002baa8 thread T0
#0 0xaaaad8291aa4 in _Py_TYPE Include/object.h:277
#1 0xaaaad8291aa4 in unicode_fromformat_arg Objects/unicodeobject.c:3076
#2 0xaaaad8291aa4 in unicode_from_format Objects/unicodeobject.c:3165
#3 0xaaaad829351c in PyUnicode_FromFormatV Objects/unicodeobject.c:3199
#4 0xaaaad852827c in _PyErr_FormatNote Python/errors.c:1259
#5 0xffffad220030 in encoder_listencode_obj Modules/_json.c:1663
#6 0xffffad21e43c in _encoder_iterate_fast_seq_lock_held Modules/_json.c:1929
#7 0xffffad21e43c in encoder_listencode_list Modules/_json.c:1991
#8 0xffffad21e43c in encoder_listencode_obj Modules/_json.c:1617
#9 0xffffad221d24 in encoder_call Modules/_json.c:1483
#10 0xaaaad7e24a10 in _PyObject_MakeTpCall Objects/call.c:242
#11 0xaaaad7bda2a4 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1620
#12 0xaaaad847c374 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:121
#13 0xaaaad847c374 in _PyEval_Vector Python/ceval.c:2005
#14 0xaaaad847c374 in PyEval_EvalCode Python/ceval.c:888
#15 0xaaaad8667950 in run_mod Python/pythonrun.c:1459
#16 0xaaaad866f4dc in pyrun_file Python/pythonrun.c:1293
#17 0xaaaad866f4dc in _PyRun_SimpleFileObject Python/pythonrun.c:521
#18 0xaaaad86706cc in _PyRun_AnyFileObject Python/pythonrun.c:81
#19 0xaaaad8725f80 in pymain_run_file_obj Modules/main.c:410
#20 0xaaaad8725f80 in pymain_run_file Modules/main.c:429
#21 0xaaaad8725f80 in pymain_run_python Modules/main.c:691
#22 0xaaaad87288c4 in Py_RunMain Modules/main.c:772
#23 0xaaaad87288c4 in pymain_main Modules/main.c:802
#24 0xaaaad87288c4 in Py_BytesMain Modules/main.c:826
#25 0xffffb01184c0 (/lib/aarch64-linux-gnu/libc.so.6+0x284c0) (BuildId: 54ae5337044aaabab70d65e0c3444f7e4735e059)
#26 0xffffb0118594 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28594) (BuildId: 54ae5337044aaabab70d65e0c3444f7e4735e059)
#27 0xaaaad7c31f6c in _start (/src/cpython/python+0x17b1f6c) (BuildId: 216debe12685ad746efca079e92d1e029dcb7128)
0x51300002baa8 is located 40 bytes inside of 328-byte region [0x51300002ba80,0x51300002bbc8)
freed by thread T0 here:
#0 0xffffb0ab61b4 in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
#1 0xaaaad81289f4 in subtype_dealloc Objects/typeobject.c:2853
#2 0xaaaad800e73c in _Py_Dealloc Objects/object.c:3200
#3 0xaaaad855bdbc in Py_DECREF_MORTAL Include/internal/pycore_object.h:482
#4 0xaaaad855bdbc in PyStackRef_XCLOSE Include/internal/pycore_stackref.h:827
#5 0xaaaad855bdbc in _PyFrame_ClearLocals Python/frame.c:101
#6 0xaaaad855c8f0 in _PyFrame_ClearExceptCode Python/frame.c:126
#7 0xaaaad8462284 in clear_thread_frame Python/ceval.c:1830
#8 0xaaaad8462284 in _PyEval_FrameClearAndPop Python/ceval.c:1854
#9 0xaaaad7bc8088 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:10403
#10 0xaaaad847d1f8 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:121
#11 0xaaaad847d1f8 in _PyEval_Vector Python/ceval.c:2005
#12 0xaaaad7e26dd8 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:169
#13 0xaaaad7e26dd8 in PyObject_CallOneArg Objects/call.c:395
#14 0xffffad21e694 in encoder_listencode_obj Modules/_json.c:1647
#15 0xffffad21e43c in _encoder_iterate_fast_seq_lock_held Modules/_json.c:1929
#16 0xffffad21e43c in encoder_listencode_list Modules/_json.c:1991
#17 0xffffad21e43c in encoder_listencode_obj Modules/_json.c:1617
#18 0xffffad221d24 in encoder_call Modules/_json.c:1483
#19 0xaaaad7e24a10 in _PyObject_MakeTpCall Objects/call.c:242
#20 0xaaaad7bda2a4 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1620
#21 0xaaaad847c374 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:121
#22 0xaaaad847c374 in _PyEval_Vector Python/ceval.c:2005
#23 0xaaaad847c374 in PyEval_EvalCode Python/ceval.c:888
#24 0xaaaad8667950 in run_mod Python/pythonrun.c:1459
#25 0xaaaad866f4dc in pyrun_file Python/pythonrun.c:1293
#26 0xaaaad866f4dc in _PyRun_SimpleFileObject Python/pythonrun.c:521
#27 0xaaaad86706cc in _PyRun_AnyFileObject Python/pythonrun.c:81
#28 0xaaaad8725f80 in pymain_run_file_obj Modules/main.c:410
#29 0xaaaad8725f80 in pymain_run_file Modules/main.c:429
#30 0xaaaad8725f80 in pymain_run_python Modules/main.c:691
#31 0xaaaad87288c4 in Py_RunMain Modules/main.c:772
#32 0xaaaad87288c4 in pymain_main Modules/main.c:802
#33 0xaaaad87288c4 in Py_BytesMain Modules/main.c:826
#34 0xffffb01184c0 (/lib/aarch64-linux-gnu/libc.so.6+0x284c0) (BuildId: 54ae5337044aaabab70d65e0c3444f7e4735e059)
#35 0xffffb0118594 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28594) (BuildId: 54ae5337044aaabab70d65e0c3444f7e4735e059)
#36 0xaaaad7c31f6c in _start (/src/cpython/python+0x17b1f6c) (BuildId: 216debe12685ad746efca079e92d1e029dcb7128)
previously allocated by thread T0 here:
#0 0xffffb0ab76d0 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0xaaaad811ded8 in _PyObject_MallocWithType Include/internal/pycore_object_alloc.h:46
#2 0xaaaad811ded8 in _PyType_AllocNoTrack Objects/typeobject.c:2505
#3 0xaaaad811e560 in PyType_GenericAlloc Objects/typeobject.c:2536
#4 0xaaaad811ffa8 in type_call Objects/typeobject.c:2449
#5 0xaaaad7e24a10 in _PyObject_MakeTpCall Objects/call.c:242
#6 0xaaaad7bda2a4 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1620
#7 0xaaaad847c374 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:121
#8 0xaaaad847c374 in _PyEval_Vector Python/ceval.c:2005
#9 0xaaaad847c374 in PyEval_EvalCode Python/ceval.c:888
#10 0xaaaad8667950 in run_mod Python/pythonrun.c:1459
#11 0xaaaad866f4dc in pyrun_file Python/pythonrun.c:1293
#12 0xaaaad866f4dc in _PyRun_SimpleFileObject Python/pythonrun.c:521
#13 0xaaaad86706cc in _PyRun_AnyFileObject Python/pythonrun.c:81
#14 0xaaaad8725f80 in pymain_run_file_obj Modules/main.c:410
#15 0xaaaad8725f80 in pymain_run_file Modules/main.c:429
#16 0xaaaad8725f80 in pymain_run_python Modules/main.c:691
#17 0xaaaad87288c4 in Py_RunMain Modules/main.c:772
#18 0xaaaad87288c4 in pymain_main Modules/main.c:802
#19 0xaaaad87288c4 in Py_BytesMain Modules/main.c:826
#20 0xffffb01184c0 (/lib/aarch64-linux-gnu/libc.so.6+0x284c0) (BuildId: 54ae5337044aaabab70d65e0c3444f7e4735e059)
#21 0xffffb0118594 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28594) (BuildId: 54ae5337044aaabab70d65e0c3444f7e4735e059)
#22 0xaaaad7c31f6c in _start (/src/cpython/python+0x17b1f6c) (BuildId: 216debe12685ad746efca079e92d1e029dcb7128)
SUMMARY: AddressSanitizer: heap-use-after-free Include/object.h:277 in _Py_TYPE
Shadow bytes around the buggy address:
0x51300002b800: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa
0x51300002b880: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x51300002b900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x51300002b980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x51300002ba00: 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x51300002ba80: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd
0x51300002bb00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x51300002bb80: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
0x51300002bc00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x51300002bc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x51300002bd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==274==ABORTING
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Bug report
Bug description:
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux