Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Crash with an evil custom mro() on a metaclass #92112

Closed
izbyshev opened this issue May 1, 2022 · 3 comments
Closed

Crash with an evil custom mro() on a metaclass #92112

izbyshev opened this issue May 1, 2022 · 3 comments
Labels
type-crash

Comments

@izbyshev
Copy link
Contributor

@izbyshev izbyshev commented May 1, 2022

Crash report

There is a path in type_mro_modified that results in double-free of *mro_meth:

A reproducer:

class B:
    pass

class M(type):
    def mro(cls):
        del M.mro
        return (B,)

class C(metaclass=M):
    pass

Crash with the debug CPython:

$ ./python mro-crasher.py
/home/test/cpython/Include/object.h:601: _Py_NegativeRefcount: Assertion failed: object has negative ref count
<object at 0x7f88c12d1a90 is freed>
Fatal Python error: _PyObject_AssertFailed: _PyObject_AssertFailed
Python runtime state: initialized

Current thread 0x00007f88c13cb080 (most recent call first):
  File "/home/test/mro-crasher.py", line 9 in <module>
Aborted (core dumped)

This bug was introduced in #73052.
@izbyshev izbyshev added the type-crash label May 1, 2022
@izbyshev
Copy link
Contributor Author

@izbyshev izbyshev commented May 1, 2022

I'll open a PR shortly.

@izbyshev
Copy link
Contributor Author

@izbyshev izbyshev commented May 1, 2022

Opened #92113. @JulienPalard

JelleZijlstra pushed a commit that referenced this issue May 6, 2022
@izbyshev
gh-92112: Fix crash triggered by an evil custom mro() (#92113)
85354ed
JelleZijlstra pushed a commit to JelleZijlstra/cpython that referenced this issue May 6, 2022
@izbyshev @JelleZijlstra
[3.10] pythongh-92112: Fix crash triggered by an evil custom mro() (p…
078e034 
…ythonGH-92113).

(cherry picked from commit 85354ed)

Co-authored-by: Alexey Izbyshev <izbyshev@ispras.ru>
JelleZijlstra pushed a commit to JelleZijlstra/cpython that referenced this issue May 6, 2022
@izbyshev @JelleZijlstra
[3.9] pythongh-92112: Fix crash triggered by an evil custom mro() (p…
2a420e9 
…ythonGH-92113).

(cherry picked from commit 85354ed)

Co-authored-by: Alexey Izbyshev <izbyshev@ispras.ru>
JelleZijlstra added a commit that referenced this issue May 7, 2022
@JelleZijlstra @izbyshev
[3.10] gh-92112: Fix crash triggered by an evil custom mro() (GH-92113
4674b31 
) (#92370)

(cherry picked from commit 85354ed)

Co-authored-by: Alexey Izbyshev <izbyshev@ispras.ru>
@JulienPalard
Copy link
Member

@JulienPalard JulienPalard commented May 11, 2022

Fixed by @izbyshev in #92113 (Thank you!).

ambv pushed a commit that referenced this issue May 16, 2022
@JelleZijlstra @izbyshev
[3.9] gh-92112: Fix crash triggered by an evil custom mro() (GH-92113…
f82b324 
…) (GH-92372)

(cherry picked from commit 85354ed)

Co-authored-by: Alexey Izbyshev <izbyshev@ispras.ru>
@The-Compiler The-Compiler mentioned this issue May 26, 2022
Open
hello-adam pushed a commit to hello-adam/cpython that referenced this issue Jun 2, 2022
@JelleZijlstra @izbyshev @hello-adam
[3.9] pythongh-92112: Fix crash triggered by an evil custom mro() (p…
0562a9e 
…ythonGH-92113) (pythonGH-92372)

(cherry picked from commit 85354ed)

Co-authored-by: Alexey Izbyshev <izbyshev@ispras.ru>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
type-crash
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@JulienPalard @izbyshev