Skip to content

Conversation

picnixz
Copy link
Member

@picnixz picnixz commented Oct 25, 2024

Copy link
Contributor

@asvetlov asvetlov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch!

Please address notes.

@bedevere-app
Copy link

bedevere-app bot commented Oct 25, 2024

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

@asvetlov asvetlov self-assigned this Oct 25, 2024
@picnixz
Copy link
Member Author

picnixz commented Oct 25, 2024

I have made the requested changes; please review again.

@bedevere-app
Copy link

bedevere-app bot commented Oct 25, 2024

Thanks for making the requested changes!

@asvetlov: please review the changes made to this pull request.

@asvetlov
Copy link
Contributor

LGTM!

@Nico-Posada
Copy link
Contributor

This might need a new issue opened, but you can still UAF on callback0 using a malicious getattribute in the loop obj

import asyncio

class EvilLoop:
    def call_soon(*args):
        # will crash before it actually gets here 
        print(args)

    def get_debug(self):
        return False

    def __getattribute__(self, name):
        global tracker
        if name == "call_soon":
            fut.remove_done_callback(tracker)
            del tracker
            print("returning get_soon fn after clearing callback0")
        
        return object.__getattribute__(self, name)

class TrackDel:
    def __del__(self):
        print("deleted", self)

fut = asyncio.Future(loop=EvilLoop())

tracker = TrackDel()
fut.add_done_callback(tracker)
fut.set_result("kaboom")

@picnixz
Copy link
Member Author

picnixz commented Oct 25, 2024

This might need a new issue opened, but you can still UAF on callback0 using a malicious getattribute in the loop obj

Let's have another issue for this one. I only noticed the OOB issue when splitting the PR.

See: #125984.

@willingc
Copy link
Contributor

Thanks @asvetlov for the review. I hope all is going well with you.

@asvetlov
Copy link
Contributor

Thank you, @willingc, I'm good.
Yeah, last years were hard to me.

@kumaraditya303
Copy link
Contributor

Good to see you back @asvetlov

@kumaraditya303 kumaraditya303 merged commit c5b99f5 into python:main Oct 25, 2024
38 checks passed
@miss-islington-app
Copy link

Thanks @picnixz for the PR, and @kumaraditya303 for merging it 🌮🎉.. I'm working now to backport this PR to: 3.12, 3.13.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 25, 2024
…l `call_soon` (pythonGH-125970)

(cherry picked from commit c5b99f5)

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
Co-authored-by: Andrew Svetlov <andrew.svetlov@gmail.com>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 25, 2024
…l `call_soon` (pythonGH-125970)

(cherry picked from commit c5b99f5)

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
Co-authored-by: Andrew Svetlov <andrew.svetlov@gmail.com>
@bedevere-app
Copy link

bedevere-app bot commented Oct 25, 2024

GH-125991 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Oct 25, 2024
@bedevere-app
Copy link

bedevere-app bot commented Oct 25, 2024

GH-125992 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.12 only security fixes label Oct 25, 2024
@picnixz picnixz deleted the fix/future-segfault-125969 branch October 25, 2024 18:20
kumaraditya303 pushed a commit that referenced this pull request Oct 25, 2024
…il `call_soon` (GH-125970) (#125992)

gh-125969: fix OOB in `future_schedule_callbacks` due to an evil `call_soon` (GH-125970)
(cherry picked from commit c5b99f5)

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
Co-authored-by: Andrew Svetlov <andrew.svetlov@gmail.com>
kumaraditya303 pushed a commit that referenced this pull request Oct 25, 2024
…il `call_soon` (GH-125970) (#125991)

gh-125969: fix OOB in `future_schedule_callbacks` due to an evil `call_soon` (GH-125970)
(cherry picked from commit c5b99f5)

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
Co-authored-by: Andrew Svetlov <andrew.svetlov@gmail.com>
@asvetlov
Copy link
Contributor

thanks, @kumaraditya303

ebonnal pushed a commit to ebonnal/cpython that referenced this pull request Jan 12, 2025
…l `call_soon` (python#125970)

Co-authored-by: Andrew Svetlov <andrew.svetlov@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants