-
-
Notifications
You must be signed in to change notification settings - Fork 32k
gh-125969: fix OOB in future_schedule_callbacks
due to an evil call_soon
#125970
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
gh-125969: fix OOB in future_schedule_callbacks
due to an evil call_soon
#125970
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good catch!
Please address notes.
A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated. Once you have made the requested changes, please leave a comment on this pull request containing the phrase |
I have made the requested changes; please review again. |
Thanks for making the requested changes! @asvetlov: please review the changes made to this pull request. |
LGTM! |
This might need a new issue opened, but you can still UAF on callback0 using a malicious getattribute in the loop obj import asyncio
class EvilLoop:
def call_soon(*args):
# will crash before it actually gets here
print(args)
def get_debug(self):
return False
def __getattribute__(self, name):
global tracker
if name == "call_soon":
fut.remove_done_callback(tracker)
del tracker
print("returning get_soon fn after clearing callback0")
return object.__getattribute__(self, name)
class TrackDel:
def __del__(self):
print("deleted", self)
fut = asyncio.Future(loop=EvilLoop())
tracker = TrackDel()
fut.add_done_callback(tracker)
fut.set_result("kaboom") |
Let's have another issue for this one. I only noticed the OOB issue when splitting the PR. See: #125984. |
Thanks @asvetlov for the review. I hope all is going well with you. |
Thank you, @willingc, I'm good. |
Good to see you back @asvetlov |
Thanks @picnixz for the PR, and @kumaraditya303 for merging it 🌮🎉.. I'm working now to backport this PR to: 3.12, 3.13. |
…l `call_soon` (pythonGH-125970) (cherry picked from commit c5b99f5) Co-authored-by: Bénédikt Tran <[email protected]> Co-authored-by: Andrew Svetlov <[email protected]>
…l `call_soon` (pythonGH-125970) (cherry picked from commit c5b99f5) Co-authored-by: Bénédikt Tran <[email protected]> Co-authored-by: Andrew Svetlov <[email protected]>
GH-125991 is a backport of this pull request to the 3.13 branch. |
GH-125992 is a backport of this pull request to the 3.12 branch. |
…il `call_soon` (GH-125970) (#125992) gh-125969: fix OOB in `future_schedule_callbacks` due to an evil `call_soon` (GH-125970) (cherry picked from commit c5b99f5) Co-authored-by: Bénédikt Tran <[email protected]> Co-authored-by: Andrew Svetlov <[email protected]>
…il `call_soon` (GH-125970) (#125991) gh-125969: fix OOB in `future_schedule_callbacks` due to an evil `call_soon` (GH-125970) (cherry picked from commit c5b99f5) Co-authored-by: Bénédikt Tran <[email protected]> Co-authored-by: Andrew Svetlov <[email protected]>
thanks, @kumaraditya303 |
…l `call_soon` (python#125970) Co-authored-by: Andrew Svetlov <[email protected]>
call_soon
may cause OOB infuture_schedule_callbacks
#125969