proxy_contains (weakref.proxy) can access an object with 0 refcount

[colesbury]

BPO	38395
Nosy	@benjaminp, @ned-deily, @ambv, @colesbury, @pablogsal, @miss-islington
PRs	bpo-38395: Fix ownership in weakref.proxy methods #16632 [3.8] bpo-38395: Fix ownership in weakref.proxy methods (GH-16632) #16661 [3.8] bpo-38395: Fix ownership in weakref.proxy methods (GH-16632) #16662 [3.7] bpo-38395: Fix ownership in weakref.proxy methods (GH-16632) #16663

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2019-10-19.22:49:35.703>
created_at = <Date 2019-10-07.14:49:09.421>
labels = ['interpreter-core', '3.7', '3.8', '3.9', 'type-crash']
title = 'proxy_contains (weakref.proxy) can access an object with 0 refcount'
updated_at = <Date 2019-10-19.22:49:35.702>
user = 'https://github.com/colesbury'

bugs.python.org fields:

activity = <Date 2019-10-19.22:49:35.702>
actor = 'benjamin.peterson'
assignee = 'none'
closed = True
closed_date = <Date 2019-10-19.22:49:35.703>
closer = 'benjamin.peterson'
components = ['Interpreter Core']
creation = <Date 2019-10-07.14:49:09.421>
creator = 'colesbury'
dependencies = []
files = []
hgrepos = []
issue_num = 38395
keywords = ['patch']
message_count = 7.0
messages = ['354102', '354157', '354161', '354219', '354231', '354490', '354978']
nosy_count = 6.0
nosy_names = ['benjamin.peterson', 'ned.deily', 'lukasz.langa', 'colesbury', 'pablogsal', 'miss-islington']
pr_nums = ['16632', '16661', '16662', '16663']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue38395'
versions = ['Python 2.7', 'Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9']

[colesbury]

The implementation of weakref.proxy's methods call back into the Python API using a "borrowed reference" of the weakly referenced object (acquired via PyWeakref_GET_OBJECT). This API call may delete the last reference to the object (either directly or via GC), leaving a dangling pointer, which can be subsequently dereferenced.

Tested with Python 3.8.0b4 (debug build)

The following code crashes with a debug build of Python 3.8.0b4 on Linux.

import weakref

obj = None

class MyObj:
    def __iter__(self):
        global obj
        del obj
        return NotImplemented

obj = MyObj()
p = weakref.proxy(obj)
print(5 in p)

This particular test case does not crash with a release build (on Linux).

The implementation of in on a proxy object calls proxy_contains:

return PySequence_Contains(PyWeakref_GET_OBJECT(proxy), value);

https://github.com/python/cpython/blob/v3.8.0b4/Objects/weakrefobject.c#L556

This eventually calls _PySequence_IterSearch. The call to PyObject_GetIter can call arbitrary code, which can lead to seq (the proxy's referent) being deleted. The subsequent call to type_error dereferences a dead object.

    it = PyObject_GetIter(seq);
    if (it == NULL) {
        type_error("argument of type '%.200s' is not iterable", seq);
        return -1;
    }

https://github.com/python/cpython/blob/v3.8.0b4/Objects/abstract.c#L2003-L2007

I believe some functions, like proxy_length, may be immune to this problem because they do not access the borrowed referent after calling into user code. However, this is hard to verify from reading the code and may be fragile -- small changes to PyObject_Length/Size, for example, might .

See also https://bugs.python.org/issue16602

[pablogsal]

I'm marking this as release blocker for the 3.8 incoming release so we don't forget about fixing this.

[benjaminp]

Note I'm going to ignore this for the purposes of 2.7.17 because it doesn't look like a new regression.

[pablogsal]

New changeset 10cd00a by Pablo Galindo in branch 'master':
bpo-38395: Fix ownership in weakref.proxy methods (GH-16632)
10cd00a

[pablogsal]

New changeset 526ef85 by Pablo Galindo in branch '3.8':
[3.8] bpo-38395: Fix ownership in weakref.proxy methods (GH-16632) (GH-16662)
526ef85

[miss-islington]

New changeset 193366e by Miss Islington (bot) (Pablo Galindo) in branch '3.7':
[3.7] bpo-38395: Fix ownership in weakref.proxy methods (GH-16632) (GH-16663)
193366e

[benjaminp]

All fixed now, right?