incorrect use of released memory in Python/pystate.c line 284

[wjq-security]

BPO	35993
Nosy	@vstinner, @ericsnowcurrently, @matrixise, @eamanu
PRs	bpo-35993: Fix an incorrect use of released memory #11852

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/matrixise'
closed_at = <Date 2019-02-20.14:30:15.802>
created_at = <Date 2019-02-14.06:21:26.451>
labels = ['type-security', 'interpreter-core', '3.8']
title = 'incorrect use of released memory in Python/pystate.c line 284'
updated_at = <Date 2019-02-20.14:30:15.801>
user = 'https://bugs.python.org/wjq-security'

bugs.python.org fields:

activity = <Date 2019-02-20.14:30:15.801>
actor = 'vstinner'
assignee = 'matrixise'
closed = True
closed_date = <Date 2019-02-20.14:30:15.802>
closer = 'vstinner'
components = ['Interpreter Core']
creation = <Date 2019-02-14.06:21:26.451>
creator = 'wjq-security'
dependencies = []
files = []
hgrepos = []
issue_num = 35993
keywords = ['patch']
message_count = 6.0
messages = ['335501', '335509', '335584', '336083', '336088', '336089']
nosy_count = 5.0
nosy_names = ['vstinner', 'eric.snow', 'matrixise', 'eamanu', 'wjq-security']
pr_nums = ['11852']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue35993'
versions = ['Python 3.8']

[wjq-security]

the code is trying to visit a link list in a loop, it tries to visit the next node in line 284 "interp = interp->next" while the current node is freed in line 296 "PyMem_RawFree(interp);"

[matrixise]

What do you think of this solution?

[wjq-security]

Just create a temporary node points to the next node before release the current node. change the loop condition if necessary.

[matrixise]

@eric Could you help me for the tests of my PR?

Thank you

[vstinner]

New changeset b5409da by Victor Stinner (Stéphane Wirtel) in branch 'master':
bpo-35993: Fix _PyInterpreterState_DeleteExceptMain() (GH-11852)
b5409da

[vstinner]

Thanks wangjiangqiang for the bug report and thanks Stéphane Wirtel for the fix!