languages/cpython
languages/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython synced 2024-10-15 00:10:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

[3.12] gh-120298: Fix use-after-free in list_richcompare_impl (GH-120303) (#120339)

Browse source 
gh-120298: Fix use-after-free in `list_richcompare_impl` (GH-120303)
(cherry picked from commit 141babad9b)

Co-authored-by: Nikita Sobolev <mail@sobolevn.me>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
This commit is contained in:
Miss Islington (bot) 2024-06-11 09:22:59 +02:00 committed by GitHub
parent f6481925d8
commit b8845369aa
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 21 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
Lib/test/test_list.py
View file

@ -229,6 +229,17 @@ def __eq__(self, other):
list4 = [1]
self.assertFalse(list3 == list4)
def test_lt_operator_modifying_operand(self):
# See gh-120298
class evil:
def __lt__(self, other):
other.clear()
return NotImplemented
a = [[evil()]]
with self.assertRaises(TypeError):
a[0] < a
@cpython_only
def test_preallocation(self):
iterable = [0] * 10

2
Misc/NEWS.d/next/Core and Builtins/2024-06-10-10-42-48.gh-issue-120298.napREA.rst Normal file
View file

@ -0,0 +1,2 @@
Fix use-after free in ``list_richcompare_impl`` which can be invoked via
some specificly tailored evil input.

9
Objects/listobject.c
View file

@ -2759,7 +2759,14 @@ list_richcompare(PyObject *v, PyObject *w, int op)
}
/* Compare the final item again using the proper operator */
return PyObject_RichCompare(vl->ob_item[i], wl->ob_item[i], op);
PyObject *vitem = vl->ob_item[i];
PyObject *witem = wl->ob_item[i];
Py_INCREF(vitem);
Py_INCREF(witem);
PyObject *result = PyObject_RichCompare(vl->ob_item[i], wl->ob_item[i], op);
Py_DECREF(vitem);
Py_DECREF(witem);
return result;
}
/*[clinic input]