-
-
Notifications
You must be signed in to change notification settings - Fork 34.5k
New generator frames have a dangling previous pointer #97752
Copy link
Copy link
Closed
Labels
3.11only security fixesonly security fixes3.12only security fixesonly security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)release-blockersprinttype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
Metadata
Metadata
Assignees
Labels
3.11only security fixesonly security fixes3.12only security fixesonly security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)release-blockersprinttype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
Projects
Status
Done
Status
Done
After
RETURN_GENERATORexecutes, the new generator's_PyInterpreterFramehas apreviousmember that still points to the caller's_PyInterpreterFrame. However, this is incorrect; it should beNULL, since the generator's frame isn't actually running anymore. This dangling pointer is dangerous, and can lead to hard crashes of the interpreter. Example:This should be
None, but instead it refers to a dead_PyInterpreterFramefrom the previous call:Making other calls "updates" this frame, since it just points to an arbitrary location in the stack:
It's also quite simple to corrupt:
This bug also appears to affect
PyAsyncGen_New,PyCoro_New,PyGen_New, andPyGen_NewWithQualName.The fix is simple: set
frame->previoustoNULLafter calls to_PyFrame_Copy. I'll open a PR at the sprint tomorrow.