gh-143378: Fix UAF when `BytesIO` is concurrently mutated during `write` operations #143408

superboy-zjc · 2026-01-04T04:06:11Z

PyObject_GetBuffer() can execute user code (e.g. via buffer), which may close or otherwise mutate a BytesIO object while write() or writelines() is in progress. This could invalidate the internal buffer and lead to a use-after-free.

Temporarily bump the exports counter while acquiring the input buffer to block re-entrant mutation, and add regression tests to ensure such cases raise BufferError instead of crashing.

Issue: Use-after-free in _io.BytesIO.writelines via re-entrant __buffer__ close #143378

…er access PyObject_GetBuffer() can execute user code (e.g. via __buffer__), which may close or otherwise mutate a BytesIO object while write() or writelines() is in progress. This could invalidate the internal buffer and lead to a use-after-free. Temporarily bump the exports counter while acquiring the input buffer to block re-entrant mutation, and add regression tests to ensure such cases raise BufferError instead of crashing.

picnixz

Can you check if we also have an exception for the pure Python implementation?

Lib/test/test_io/test_memoryio.py

Misc/NEWS.d/next/Library/2026-01-03-19-41-36.gh-issue-143378.29AvE7.rst

bedevere-app · 2026-01-04T17:52:03Z

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

Modules/_io/bytesio.c

superboy-zjc · 2026-01-04T18:52:10Z

Can you check if we also have an exception for the pure Python implementation?

Hi I can confirm currently we don't have an exception catching the concurrent mutation during a write in Python implementation. Should we keep this behavior consistent between C and Python version?

I'd be happy to add this logic check and unit tests as well. A potential patch for python version would be something like:

diff --git a/Lib/_pyio.py b/Lib/_pyio.py
index 69a088df8f..5b684c8f46 100644
--- a/Lib/_pyio.py
+++ b/Lib/_pyio.py
@@ -955,6 +955,8 @@ def write(self, b):
             raise TypeError("can't write str to binary stream")
         with memoryview(b) as view:
             n = view.nbytes  # Size of any bytes-like object
+        if self.closed:
+            raise ValueError("write to closed file")
         if n == 0:
             return 0

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

superboy-zjc · 2026-01-04T19:27:11Z

I have made the requested changes; please review again.

bedevere-app · 2026-01-04T19:27:16Z

Thanks for making the requested changes!

@picnixz: please review the changes made to this pull request.

picnixz · 2026-01-04T19:29:03Z

Hi I can confirm currently we don't have an exception catching the concurrent mutation during a write in Python implementation. Should we keep this behavior consistent between C and Python version?

I think but let's ask @cmaloney and @serhiy-storchaka about this. Sometimes it's not a good idea to force an exception just for consistency and it may not be useful either (and we apply GIGO paradigm in this case)

serhiy-storchaka

I think that it would be better to call check_closed() and check_exports() after we get a buffer.

Correspondingly, in the Python code we should perform these checks inside the with memoryview(...) block.

serhiy-storchaka

If the stream is closed concurrently with writing, BufferError is not an expected exception. You should get a usual exception that you get when trying to write to already closed stream.

Please add also a test for writelines().

It would also be interesting to add a test when the stream buffer is exported concurrently with writing -- in that case BufferError can be an expected exception.

…ython implementation

superboy-zjc · 2026-01-05T00:19:07Z

If the stream is closed concurrently with writing, BufferError is not an expected exception. You should get a usual exception that you get when trying to write to already closed stream.

Please add also a test for writelines().

It would also be interesting to add a test when the stream buffer is exported concurrently with writing -- in that case BufferError can be an expected exception.

Sounds great! I've updated the code following the suggestion. It indeed improves consistency and matches the expected behavior.

Regarding the unit tests, I've added coverage for concurrent export and close for both write() and writelines. Currently they are implemented as separate test cases for clarity. I did consider subtests to reduce duplication, but this felt a bit clearer in this case. I’m happy to refactor them into subtests if you think that would be preferable.

serhiy-storchaka

LGTM. 👍

You can either merge tests for write() and writelines() since they share the same class (it only needs copying the last two lines). Or leave it as is. Either is fine.

Please add a NEWS entry.

There is other bug in the Python implementation. It is easy to fix, but you can prefer to open a separate issue for it, because the test will be more complicated (__buffer__() needs to return different values).

serhiy-storchaka · 2026-01-05T10:40:17Z

Lib/_pyio.py

            n = view.nbytes  # Size of any bytes-like object
+            if self.closed:
+                raise ValueError("write to closed file")
        if n == 0:


The rest of the code should be moved in the with block.

Otherwise writing to BytesIO after seeking can not just overwrite existing bytes, but move bytes after the current position.

This is a separate bug, so you can open a separate issue and fix it in a separate PR.

I suggest removing the first if self.closed: at the function entry point.

I suggest removing the first if self.closed: at the function entry point.

Thank you for pointing it out! I've updated the code. This is very helpful to keep the consistency.

See #143602.

serhiy-storchaka · 2026-01-05T10:46:22Z

Lib/test/test_io/test_memoryio.py

+        # Prevent crashes when memio.write() concurrently exports 'memio'.
+        # See: https://github.com/python/cpython/issues/143378.
+        class B:
+            buf = None


This is not needed if you never read it.

Yes, I think we should just have memio.getbuffer()

We need to save a reference to it.

Oh right, so _ = memio.getbuffer()

We need to keep a reference after returning from __buffer__().

Initially I though about a local variable in the outer scope (an initialization would be needed in that case), but an attribute of the written object works as well.

Oh right. Sorry. Yes an attribute would be just the best :')

Lib/test/test_io/test_memoryio.py

concerns were addressed

Modules/_io/bytesio.c

kumaraditya303

bytesio.c changes LGTM

…tion

miss-islington-app · 2026-01-09T11:52:14Z

Thanks @superboy-zjc for the PR, and @serhiy-storchaka for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

miss-islington-app · 2026-01-09T11:52:14Z

Thanks @superboy-zjc for the PR, and @serhiy-storchaka for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

miss-islington-app · 2026-01-09T11:52:16Z

Sorry, @superboy-zjc and @serhiy-storchaka, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 6d54b6ac7d5744e1f59d784c8e020d632d2959a3 3.13

…ted during write operations (pythonGH-143408) PyObject_GetBuffer() can execute user code (e.g. via __buffer__), which may close or otherwise mutate a BytesIO object while write() or writelines() is in progress. This could invalidate the internal buffer and lead to a use-after-free. Ensure that PyObject_GetBuffer() is called before validation checks. (cherry picked from commit 6d54b6a) Co-authored-by: zhong <60600792+superboy-zjc@users.noreply.github.com>

bedevere-app · 2026-01-09T11:52:30Z

GH-143599 is a backport of this pull request to the 3.14 branch.

…ly mutated during write operations (pythonGH-143408) PyObject_GetBuffer() can execute user code (e.g. via __buffer__), which may close or otherwise mutate a BytesIO object while write() or writelines() is in progress. This could invalidate the internal buffer and lead to a use-after-free. Ensure that PyObject_GetBuffer() is called before validation checks. (cherry picked from commit 6d54b6a) Co-authored-by: zhong <60600792+superboy-zjc@users.noreply.github.com>

bedevere-app · 2026-01-09T11:59:35Z

GH-143600 is a backport of this pull request to the 3.13 branch.

…ated during write operations (GH-143408) (GH-143599) PyObject_GetBuffer() can execute user code (e.g. via __buffer__), which may close or otherwise mutate a BytesIO object while write() or writelines() is in progress. This could invalidate the internal buffer and lead to a use-after-free. Ensure that PyObject_GetBuffer() is called before validation checks. (cherry picked from commit 6d54b6a) Co-authored-by: zhong <60600792+superboy-zjc@users.noreply.github.com>

bedevere-app bot added the awaiting review label Jan 4, 2026

bedevere-app bot mentioned this pull request Jan 4, 2026

Use-after-free in _io.BytesIO.writelines via re-entrant __buffer__ close #143378

Closed

pythongh-143378: Fix Sphinx references in NEWS entry

2c3035c

picnixz previously requested changes Jan 4, 2026

View reviewed changes

bedevere-app bot removed the awaiting review label Jan 4, 2026

bedevere-app bot added the awaiting changes label Jan 4, 2026

picnixz changed the title ~~gh-143378: Fix use-after-free BytesIO write via re-entrant buffer access~~ gh-143378: Fix UAF when BytesIO is concurrently mutated during write operations Jan 4, 2026

picnixz reviewed Jan 4, 2026

View reviewed changes

Modules/_io/bytesio.c Outdated Show resolved Hide resolved

superboy-zjc and others added 6 commits January 4, 2026 11:00

Update Lib/test/test_io/test_memoryio.py

1a667a4

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Update Modules/_io/bytesio.c

35f9856

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Update Lib/test/test_io/test_memoryio.py

5997e90

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

pythongh-143378: reduce duplication in unit tests per review

27c99da

pythongh-143378: address review comments in NEWS entry

586fbdc

pythongh-143378: clean up unit tests

89b2cb7

bedevere-app bot added awaiting change review and removed awaiting changes labels Jan 4, 2026

bedevere-app bot requested a review from picnixz January 4, 2026 19:27

serhiy-storchaka reviewed Jan 4, 2026

View reviewed changes

pythongh-143378: refactor the buffer check and unit tests for C and P…

7805fa1

…ython implementation

serhiy-storchaka approved these changes Jan 5, 2026

View reviewed changes

bedevere-app bot added awaiting merge and removed awaiting change review labels Jan 5, 2026

picnixz reviewed Jan 5, 2026

View reviewed changes

Lib/test/test_io/test_memoryio.py Outdated Show resolved Hide resolved

superboy-zjc and others added 2 commits January 5, 2026 21:22

pythongh-143378: clean up test comments

6ac90be

Merge branch 'main' into issue-143378

9956cef

kumaraditya303 reviewed Jan 6, 2026

View reviewed changes

Modules/_io/bytesio.c Show resolved Hide resolved

pythongh-143378: clean up duplicated shape check

2155e48

kumaraditya303 approved these changes Jan 8, 2026

View reviewed changes

pythongh-143378: clean up duplicated shape check in Python implementa…

4f0b8b6

…tion

serhiy-storchaka merged commit 6d54b6a into python:main Jan 9, 2026
46 checks passed

bedevere-app bot removed the awaiting merge label Jan 9, 2026

serhiy-storchaka added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Jan 9, 2026

miss-islington-app bot assigned serhiy-storchaka Jan 9, 2026

bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Jan 9, 2026

bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Jan 9, 2026

serhiy-storchaka mentioned this pull request Jan 9, 2026

Incorrect behavior of BytesIO.write() when the size of the written data changed during writing #143602

Open

Uh oh!

gh-143378: Fix UAF when BytesIO is concurrently mutated during write operations #143408

gh-143378: Fix UAF when BytesIO is concurrently mutated during write operations #143408

Conversation

superboy-zjc commented Jan 4, 2026 • edited by bedevere-app bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

picnixz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bedevere-app bot commented Jan 4, 2026

Uh oh!

Uh oh!

superboy-zjc commented Jan 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

superboy-zjc commented Jan 4, 2026

Uh oh!

bedevere-app bot commented Jan 4, 2026

Uh oh!

picnixz commented Jan 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

serhiy-storchaka left a comment

Choose a reason for hiding this comment

Uh oh!

serhiy-storchaka left a comment

Choose a reason for hiding this comment

Uh oh!

superboy-zjc commented Jan 5, 2026

Uh oh!

serhiy-storchaka left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

superboy-zjc Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

kumaraditya303 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

miss-islington-app bot commented Jan 9, 2026

Uh oh!

miss-islington-app bot commented Jan 9, 2026

Uh oh!

miss-islington-app bot commented Jan 9, 2026

Uh oh!

bedevere-app bot commented Jan 9, 2026

Uh oh!

bedevere-app bot commented Jan 9, 2026

Uh oh!

Reviewers

Assignees

Labels

gh-143378: Fix UAF when `BytesIO` is concurrently mutated during `write` operations #143408

gh-143378: Fix UAF when `BytesIO` is concurrently mutated during `write` operations #143408

superboy-zjc commented Jan 4, 2026 •

edited by bedevere-app bot

Loading

superboy-zjc commented Jan 4, 2026 •

edited

Loading

picnixz commented Jan 4, 2026 •

edited

Loading

superboy-zjc Jan 8, 2026 •

edited

Loading