Skip to content

bpo-46561: Ensure operands to __get__ survive the call #30979

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
+10 −2
Open

bpo-46561: Ensure operands to __get__ survive the call #30979

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a47eaac
Ensure operands to __get__ survive the call
tekknolagi Jan 28, 2022
a86fdcc
📜🤖 Added by blurb_it.
blurb-it[bot] Jan 28, 2022
a23a62e
Merge branch 'main' into mb-fix-__get__
serhiy-storchaka Feb 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
Ensure operands to __get__ survive the call 
Callees can assume their parameters survive for the entire call. This
violates that assumption and can cause a use-after-free.

This is not an issue in CPython right now because later on in the
interpreter __get__ fastcall path, the whole vector of arguments get
INCREFed. However, if a program provides a different entrypoint for a
vectorcall, it may crash.
  • Loading branch information
@tekknolagi
tekknolagi committed Jan 28, 2022
commit a47eaacc166e6b1381ce7b8ae013a0bb5ea8f21c
11 changes: 9 additions & 2 deletions Objects/typeobject.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1613,8 +1613,12 @@ _PyObject_LookupSpecial(PyObject *self, _Py_Identifier *attrid)
descrgetfunc f;
if ((f = Py_TYPE(res)->tp_descr_get) == NULL)
Py_INCREF(res);
else
res = f(res, self, (PyObject *)(Py_TYPE(self)));
else {
PyObject* descr = res;
Py_INCREF(descr);
res = f(descr, self, (PyObject *)(Py_TYPE(self)));
Py_DECREF(descr);
}
}
return res;
}
Expand All @@ -1639,7 +1643,10 @@ lookup_maybe_method(PyObject *self, _Py_Identifier *attrid, int *unbound)
Py_INCREF(res);
}
else {
PyObject* descr = res;
Py_INCREF(descr);
res = f(res, self, (PyObject *)(Py_TYPE(self)));
Py_DECREF(descr);
}
}
return res;
Expand Down