Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gh-125969: fix OOB in future_schedule_callbacks due to an evil call_soon #125970

Merged
merged 8 commits into from
Oct 25, 2024

Conversation

picnixz
Copy link
Contributor

@picnixz picnixz commented Oct 25, 2024

Modules/_asynciomodule.c Outdated Show resolved Hide resolved
Copy link
Contributor

@asvetlov asvetlov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch!

Please address notes.

Modules/_asynciomodule.c Outdated Show resolved Hide resolved
Modules/_asynciomodule.c Outdated Show resolved Hide resolved
@bedevere-app
Copy link

bedevere-app bot commented Oct 25, 2024

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

@asvetlov asvetlov self-assigned this Oct 25, 2024
@picnixz
Copy link
Contributor Author

picnixz commented Oct 25, 2024

I have made the requested changes; please review again.

@bedevere-app
Copy link

bedevere-app bot commented Oct 25, 2024

Thanks for making the requested changes!

@asvetlov: please review the changes made to this pull request.

@asvetlov
Copy link
Contributor

LGTM!

@Nico-Posada
Copy link

This might need a new issue opened, but you can still UAF on callback0 using a malicious getattribute in the loop obj

import asyncio

class EvilLoop:
    def call_soon(*args):
        # will crash before it actually gets here 
        print(args)

    def get_debug(self):
        return False

    def __getattribute__(self, name):
        global tracker
        if name == "call_soon":
            fut.remove_done_callback(tracker)
            del tracker
            print("returning get_soon fn after clearing callback0")
        
        return object.__getattribute__(self, name)

class TrackDel:
    def __del__(self):
        print("deleted", self)

fut = asyncio.Future(loop=EvilLoop())

tracker = TrackDel()
fut.add_done_callback(tracker)
fut.set_result("kaboom")

@picnixz
Copy link
Contributor Author

picnixz commented Oct 25, 2024

This might need a new issue opened, but you can still UAF on callback0 using a malicious getattribute in the loop obj

Let's have another issue for this one. I only noticed the OOB issue when splitting the PR.

See: #125984.

@willingc
Copy link
Contributor

Thanks @asvetlov for the review. I hope all is going well with you.

@asvetlov
Copy link
Contributor

Thank you, @willingc, I'm good.
Yeah, last years were hard to me.

@kumaraditya303
Copy link
Contributor

Good to see you back @asvetlov

@kumaraditya303 kumaraditya303 merged commit c5b99f5 into python:main Oct 25, 2024
38 checks passed
@miss-islington-app
Copy link

Thanks @picnixz for the PR, and @kumaraditya303 for merging it 🌮🎉.. I'm working now to backport this PR to: 3.12, 3.13.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 25, 2024
…l `call_soon` (pythonGH-125970)

(cherry picked from commit c5b99f5)

Co-authored-by: Bénédikt Tran <[email protected]>
Co-authored-by: Andrew Svetlov <[email protected]>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 25, 2024
…l `call_soon` (pythonGH-125970)

(cherry picked from commit c5b99f5)

Co-authored-by: Bénédikt Tran <[email protected]>
Co-authored-by: Andrew Svetlov <[email protected]>
@bedevere-app
Copy link

bedevere-app bot commented Oct 25, 2024

GH-125991 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Oct 25, 2024
@bedevere-app
Copy link

bedevere-app bot commented Oct 25, 2024

GH-125992 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.12 bug and security fixes label Oct 25, 2024
@picnixz picnixz deleted the fix/future-segfault-125969 branch October 25, 2024 18:20
kumaraditya303 pushed a commit that referenced this pull request Oct 25, 2024
…il `call_soon` (GH-125970) (#125992)

gh-125969: fix OOB in `future_schedule_callbacks` due to an evil `call_soon` (GH-125970)
(cherry picked from commit c5b99f5)

Co-authored-by: Bénédikt Tran <[email protected]>
Co-authored-by: Andrew Svetlov <[email protected]>
kumaraditya303 pushed a commit that referenced this pull request Oct 25, 2024
…il `call_soon` (GH-125970) (#125991)

gh-125969: fix OOB in `future_schedule_callbacks` due to an evil `call_soon` (GH-125970)
(cherry picked from commit c5b99f5)

Co-authored-by: Bénédikt Tran <[email protected]>
Co-authored-by: Andrew Svetlov <[email protected]>
@asvetlov
Copy link
Contributor

thanks, @kumaraditya303

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants