-
-
Notifications
You must be signed in to change notification settings - Fork 30.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
New generator frames have a dangling previous
pointer
#97752
Labels
3.11
only security fixes
3.12
bugs and security fixes
interpreter-core
(Objects, Python, Grammar, and Parser dirs)
release-blocker
sprint
type-crash
A hard crash of the interpreter, possibly with a core dump
Comments
brandtbucher
added
sprint
interpreter-core
(Objects, Python, Grammar, and Parser dirs)
release-blocker
3.11
only security fixes
type-crash
A hard crash of the interpreter, possibly with a core dump
3.12
bugs and security fixes
needs backport to 3.11
only security fixes
labels
Oct 3, 2022
CC @markshannon |
markshannon
pushed a commit
that referenced
this issue
Oct 3, 2022
miss-islington
pushed a commit
to miss-islington/cpython
that referenced
this issue
Oct 3, 2022
…r/coroutine frames (pythonGH-97795) (cherry picked from commit 93fcc1f) Co-authored-by: Brandt Bucher <[email protected]>
brandtbucher
pushed a commit
that referenced
this issue
Oct 4, 2022
@brandtbucher Since gh-97812 is merged, can this issue be closed or have its |
I'd prefer to leave it open, and let @pablogsal close it once the cherry-pick to 3.11.0 is finished. |
@pablogsal This issue seems to be eligible for closing (see the comment above). |
Repository owner
moved this from Todo
to Done
in Sprint 2024
Oct 22, 2022
Repository owner
moved this from Todo
to Done
in Release and Deferred blockers 🚫
Oct 22, 2022
pablogsal
pushed a commit
that referenced
this issue
Oct 22, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
3.11
only security fixes
3.12
bugs and security fixes
interpreter-core
(Objects, Python, Grammar, and Parser dirs)
release-blocker
sprint
type-crash
A hard crash of the interpreter, possibly with a core dump
After
RETURN_GENERATOR
executes, the new generator's_PyInterpreterFrame
has aprevious
member that still points to the caller's_PyInterpreterFrame
. However, this is incorrect; it should beNULL
, since the generator's frame isn't actually running anymore. This dangling pointer is dangerous, and can lead to hard crashes of the interpreter. Example:This should be
None
, but instead it refers to a dead_PyInterpreterFrame
from the previous call:Making other calls "updates" this frame, since it just points to an arbitrary location in the stack:
It's also quite simple to corrupt:
This bug also appears to affect
PyAsyncGen_New
,PyCoro_New
,PyGen_New
, andPyGen_NewWithQualName
.The fix is simple: set
frame->previous
toNULL
after calls to_PyFrame_Copy
. I'll open a PR at the sprint tomorrow.The text was updated successfully, but these errors were encountered: