Thanks to visit codestin.com
Credit goes to github.com

Skip to content

_lsprof.Profiler._creturn_callback() segfaults #126220

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
devdanzin opened this issue Oct 31, 2024 · 2 comments
Closed

_lsprof.Profiler._creturn_callback() segfaults #126220

devdanzin opened this issue Oct 31, 2024 · 2 comments
Assignees
@sobolevn
Labels
3.12 only security fixes 3.13 bugs and security fixes 3.14 bugs and security fixes extension-modules C modules in the Modules dir type-crash A hard crash of the interpreter, possibly with a core dump

Comments

@devdanzin
Copy link
Contributor

devdanzin commented Oct 31, 2024 •
edited by bedevere-app bot
Loading

Crash report

What happened?

It's possible to crash Python by simply calling the ._creturn_callback() or the ._ccall_callback() methods of the Profiler class in either _lsprof or cProfile.

from _lsprof import Profiler
Profiler()._creturn_callback()
Profiler()._ccall_callback()

Backtrace looks like:

Program received signal SIGSEGV, Segmentation fault.
get_cfunc_from_callable (callable=0x0, self_arg=0x7ffff7bff710, missing=0x555555c53b80 <_PyInstrumentation_MISSING>) at ./Modules/_lsprof.c:628
628         if (PyCFunction_Check(callable)) {
(gdb) bt
#0  get_cfunc_from_callable (callable=0x0, self_arg=0x7ffff7bff710,
    missing=0x555555c53b80 <_PyInstrumentation_MISSING>) at ./Modules/_lsprof.c:628
#1  0x00007ffff79dd610 in creturn_callback (self=0x7ffff7a91050, args=<optimized out>,
    size=<optimized out>) at ./Modules/_lsprof.c:676
#2  0x000055555568f4b9 in method_vectorcall_FASTCALL (func=0x7ffff7aba630, args=0x7ffff7fb0078,
    nargsf=<optimized out>, kwnames=<optimized out>) at Objects/descrobject.c:401
#3  0x000055555567ba55 in _PyObject_VectorcallTstate (tstate=0x555555cbbc70 <_PyRuntime+329232>,
    callable=0x7ffff7aba630, args=0x7ffff7fb0078, nargsf=9223372036854775809, kwnames=0x0)
    at ./Include/internal/pycore_call.h:167
#4  0x000055555567bb74 in PyObject_Vectorcall (callable=callable@entry=0x7ffff7aba630,
    args=args@entry=0x7ffff7fb0078, nargsf=<optimized out>, kwnames=kwnames@entry=0x0)
    at Objects/call.c:327
#5  0x0000555555827d24 in _PyEval_EvalFrameDefault (
    tstate=tstate@entry=0x555555cbbc70 <_PyRuntime+329232>, frame=0x7ffff7fb0020,
    throwflag=throwflag@entry=0) at Python/generated_cases.c.h:955
#6  0x0000555555852fb7 in _PyEval_EvalFrame (throwflag=0, frame=<optimized out>,
    tstate=0x555555cbbc70 <_PyRuntime+329232>) at ./Include/internal/pycore_ceval.h:116
#7  _PyEval_Vector (tstate=tstate@entry=0x555555cbbc70 <_PyRuntime+329232>,
    func=func@entry=0x7ffff7a46450, locals=locals@entry=0x7ffff7a55df0, args=args@entry=0x0,
    argcount=argcount@entry=0, kwnames=kwnames@entry=0x0) at Python/ceval.c:1886
#8  0x0000555555853096 in PyEval_EvalCode (co=co@entry=0x7ffff7a58630,
    globals=globals@entry=0x7ffff7a55df0, locals=locals@entry=0x7ffff7a55df0) at Python/ceval.c:662
#9  0x00005555559251f4 in run_eval_code_obj (tstate=tstate@entry=0x555555cbbc70 <_PyRuntime+329232>,
    co=co@entry=0x7ffff7a58630, globals=globals@entry=0x7ffff7a55df0, locals=locals@entry=0x7ffff7a55df0)
    at Python/pythonrun.c:1338

Found using fusil by @vstinner.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux, Windows

Output from running 'python -VV' on the command line:

No response

Linked PRs
@devdanzin devdanzin added the type-crash A hard crash of the interpreter, possibly with a core dump label Oct 31, 2024
@ZeroIntensity ZeroIntensity added the extension-modules C modules in the Modules dir label Oct 31, 2024
@sobolevn
Copy link
Member

Not just these two, but also others (like _pystart_callback) all from #103534 CC @gaogaotiantian

This happens because args is never checked to have a proper length. I think that TypeError should be raised when these function do not have enough arguments (like we always do).

I am working on a fix :)

@sobolevn sobolevn self-assigned this Oct 31, 2024
sobolevn added a commit to sobolevn/cpython that referenced this issue Oct 31, 2024
@sobolevn
pythongh-126220: Fix crash on calls to _lsprof.Profiler methods wit…
299f63f 
…h 0 args
@bedevere-app bedevere-app bot mentioned this issue Oct 31, 2024
Merged
sobolevn added a commit to sobolevn/cpython that referenced this issue Nov 1, 2024
@sobolevn
pythongh-126220: Fix crash on calls to _lsprof.Profiler methods wit…
a748d98 
…h 0 args
@bedevere-app bedevere-app bot mentioned this issue Nov 1, 2024
Merged
@picnixz picnixz added 3.12 only security fixes 3.13 bugs and security fixes 3.14 bugs and security fixes labels Nov 1, 2024
sobolevn added a commit that referenced this issue Nov 1, 2024
@sobolevn @erlend-aasland
gh-126220: Fix crash on calls to _lsprof.Profiler methods with 0 ar…
28b148f 
…gs (backportable) (#126271)

Co-authored-by: Erlend E. Aasland <[email protected]>
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Nov 1, 2024
@sobolevn @erlend-aasland @miss-islington
pythongh-126220: Fix crash on calls to _lsprof.Profiler methods wit…
144447c 
…h 0 args (backportable) (pythonGH-126271)

(cherry picked from commit 28b148f)

Co-authored-by: sobolevn <[email protected]>
Co-authored-by: Erlend E. Aasland <[email protected]>
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Nov 1, 2024
@sobolevn @erlend-aasland @miss-islington
pythongh-126220: Fix crash on calls to _lsprof.Profiler methods wit…
4197d40 
…h 0 args (backportable) (pythonGH-126271)

(cherry picked from commit 28b148f)

Co-authored-by: sobolevn <[email protected]>
Co-authored-by: Erlend E. Aasland <[email protected]>
This was referenced Nov 1, 2024
Merged
Merged
sobolevn added a commit that referenced this issue Nov 1, 2024
@miss-islington @sobolevn @erlend-aasland
[3.12] gh-126220: Fix crash on calls to _lsprof.Profiler methods wi…
b5c19bd 
…th 0 args (backportable) (GH-126271) (#126311)

gh-126220: Fix crash on calls to `_lsprof.Profiler` methods with 0 args (backportable) (GH-126271)
(cherry picked from commit 28b148f)

Co-authored-by: sobolevn <[email protected]>
Co-authored-by: Erlend E. Aasland <[email protected]>
sobolevn added a commit that referenced this issue Nov 1, 2024
@miss-islington @sobolevn @erlend-aasland
[3.13] gh-126220: Fix crash on calls to _lsprof.Profiler methods wi…
1b9710c 
…th 0 args (backportable) (GH-126271) (#126310)

gh-126220: Fix crash on calls to `_lsprof.Profiler` methods with 0 args (backportable) (GH-126271)
(cherry picked from commit 28b148f)

Co-authored-by: sobolevn <[email protected]>
Co-authored-by: Erlend E. Aasland <[email protected]>
sobolevn added a commit that referenced this issue Nov 4, 2024
@sobolevn @erlend-aasland
gh-126220: Adapt _lsprof to Argument Clinic (#126233)
c806cd5 
Co-authored-by: Erlend E. Aasland <[email protected]>
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Nov 4, 2024
@sobolevn @erlend-aasland @miss-islington
pythongh-126220: Adapt _lsprof to Argument Clinic (pythonGH-126233)
9eaf3e6 
(cherry picked from commit c806cd5)

Co-authored-by: sobolevn <[email protected]>
Co-authored-by: Erlend E. Aasland <[email protected]>
@bedevere-app bedevere-app bot mentioned this issue Nov 4, 2024
Closed
@vstinner
Copy link
Member

vstinner commented Nov 6, 2024

Can we close this isue?

@sobolevn sobolevn closed this as completed Nov 6, 2024
picnixz pushed a commit to picnixz/cpython that referenced this issue Dec 8, 2024
@sobolevn @erlend-aasland @picnixz
pythongh-126220: Fix crash on calls to _lsprof.Profiler methods wit…
590269e 
…h 0 args (backportable) (python#126271)

Co-authored-by: Erlend E. Aasland <[email protected]>
picnixz pushed a commit to picnixz/cpython that referenced this issue Dec 8, 2024
@sobolevn @erlend-aasland @picnixz
pythongh-126220: Adapt _lsprof to Argument Clinic (python#126233)
c86f49b 
Co-authored-by: Erlend E. Aasland <[email protected]>
ebonnal pushed a commit to ebonnal/cpython that referenced this issue Jan 12, 2025
@sobolevn @erlend-aasland @ebonnal
pythongh-126220: Fix crash on calls to _lsprof.Profiler methods wit…
8829f6d 
…h 0 args (backportable) (python#126271)

Co-authored-by: Erlend E. Aasland <[email protected]>
ebonnal pushed a commit to ebonnal/cpython that referenced this issue Jan 12, 2025
@sobolevn @erlend-aasland @ebonnal
pythongh-126220: Adapt _lsprof to Argument Clinic (python#126233)
2081eee 
Co-authored-by: Erlend E. Aasland <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@sobolevn sobolevn

Labels
3.12 only security fixes 3.13 bugs and security fixes 3.14 bugs and security fixes extension-modules C modules in the Modules dir type-crash A hard crash of the interpreter, possibly with a core dump
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@vstinner @sobolevn @picnixz @ZeroIntensity @devdanzin