Access violation due to CancelSynchronousIo of console read

[eryksun]

BPO	30237
Nosy	@pfmoore, @tjguk, @zware, @eryksun, @zooba, @ZackerySpytz
PRs	bpo-30237: Output error when ReadConsole is canceled by CancelSynchronousIo. #7911 [3.7] bpo-30237: Output error when ReadConsole is canceled by CancelSynchronousIo. (GH-7911) #8342 [3.6] bpo-30237: Output error when ReadConsole is canceled by CancelSynchronousIo. (GH-7911) #8343

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2019-07-23.15:42:40.216>
created_at = <Date 2017-05-02.17:46:07.589>
labels = ['easy', 'expert-IO', '3.7', 'OS-windows', 'type-crash']
title = 'Access violation due to CancelSynchronousIo of console read'
updated_at = <Date 2019-07-23.15:42:40.215>
user = 'https://github.com/eryksun'

bugs.python.org fields:

activity = <Date 2019-07-23.15:42:40.215>
actor = 'steve.dower'
assignee = 'none'
closed = True
closed_date = <Date 2019-07-23.15:42:40.216>
closer = 'steve.dower'
components = ['Windows', 'IO']
creation = <Date 2017-05-02.17:46:07.589>
creator = 'eryksun'
dependencies = []
files = []
hgrepos = []
issue_num = 30237
keywords = ['patch', 'easy (C)']
message_count = 7.0
messages = ['292791', '292793', '321970', '322621', '322622', '348322', '348337']
nosy_count = 6.0
nosy_names = ['paul.moore', 'tim.golden', 'zach.ware', 'eryksun', 'steve.dower', 'ZackerySpytz']
pr_nums = ['7911', '8342', '8343']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue30237'
versions = ['Python 3.6', 'Python 3.7']

[eryksun]

When ReadConsole is canceled by CancelSynchronousIo 1, for some reason the call still succeeds. It's probably related to the hack that maps STATUS_ALERTED to ERROR_OPERATION_ABORTED when a console read is interrupted by Ctrl+C.

The problem is that, when canceled, ReadConsole doesn't update the value of lpNumberOfCharsRead. Thus in read_console_w in Modules/_io/winconsoleio.c, the value of n is a random number that gets added to readlen, which is subsequently used to index into buf. The problem is the same for n_read in _PyOS_WindowsConsoleReadline.

For example, in 3.6:

    import sys, ctypes, threading
    kernel32 = ctypes.WinDLL('kernel32')
    hMain = kernel32.OpenThread(1, 0, kernel32.GetCurrentThreadId())
    t = threading.Timer(30, kernel32.CancelSynchronousIo, (hMain,))
    t.start()
    sys.stdin.readline()

Breakpoint 0 hit
KERNELBASE!ReadConsoleW:
00007ffc`fb558200 4053            push    rbx
0:000> pt
KERNELBASE!GetImmersiveColorTypeFromName+0x49d2:
00007ffc`fb5d2672 c3              ret
0:000> r rax
rax=0000000000000001
0:000> ?? @$teb->LastErrorValue == 995
bool true

0:000> gu
python36!read_console_w+0x8b:
00000000`6e43a483 85c0            test    eax,eax
0:000> ?? n
unsigned long 0xefdc39e8
0:000> g
(1154.11fc): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
python36!read_console_w+0x11f:
00000000`6e43a517 66833a0a        cmp     word ptr [rdx],0Ah
                                        ds:000001e8`cfb72c7e=????

If the value of n is initialized to (DWORD)-1, then checking for a failed or canceled call could be implemented as follows:

if (!res || (n == (DWORD)-1 && GetLastError() ==
    ERROR_OPERATION_ABORTED)) {
    err = GetLastError();
    break;
}

[eryksun]

Oops, I pasted the MSDN link for ReadConsole instead of CancelSynchronousIo 1.

[zooba]

New changeset ce75df3 by Steve Dower (ValeriyaSinevich) in branch 'master':
bpo-30237: Output error when ReadConsole is canceled by CancelSynchronousIo. (GH-7911)
ce75df3

[zooba]

New changeset c3af73d by Steve Dower (Miss Islington (bot)) in branch '3.7':
bpo-30237: Output error when ReadConsole is canceled by CancelSynchronousIo. (GH-7911)
c3af73d

[zooba]

New changeset 28bbbda by Steve Dower in branch '3.6':
bpo-30237: Output error when ReadConsole is canceled by CancelSynchronousIo. (GH-7911)
28bbbda

[ZackerySpytz]

PR 7911 was merged and backported. Should this issue be closed?

[zooba]

Yep, thanks for the ping!