Thanks to visit codestin.com
Credit goes to github.com

Skip to content

_interpreters.exec with invalid dict as shared segfaults #127196

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
devdanzin opened this issue Nov 23, 2024 · 2 comments
Closed

_interpreters.exec with invalid dict as shared segfaults #127196

devdanzin opened this issue Nov 23, 2024 · 2 comments
Assignees
@sobolevn
Labels
3.13 bugs and security fixes 3.14 bugs and security fixes extension-modules C modules in the Modules dir topic-subinterpreters type-crash A hard crash of the interpreter, possibly with a core dump

Comments

@devdanzin
Copy link
Contributor

devdanzin commented Nov 23, 2024 •
edited by bedevere-app bot
Loading

Crash report

What happened?

Passing a dict with an invalid key as the shared parameter to _interpreters.exec segfaults the interpreter (or aborts in a debug build):

import _interpreters
_interpreters.exec(0, "1", {"\uFD7C\u5124\u7B91\u92E9\u1850\u39AA\u0DF2\uD82A\u2D68\uACAD\u92DE\u47C5\uFFD0\uDE0B\uAA9C\u2C17\\u6577\u4C92\uD37C": 0})

Backtrace:

#0  0x00005555557c496c in _PyXI_ApplyError (error=0x0) at Python/crossinterp.c:1056
#1  0x00007ffff79db822 in _run_in_interpreter (p_excinfo=0x7fffffffd820, flags=1,
    shareables=0x7ffff7a186c0, codestrlen=<optimized out>, codestr=0x555555aceff8 <_PyRuntime+76888> "1",
    interp=0x555555ad1f18 <_PyRuntime+88952>) at ./Modules/_interpretersmodule.c:463
]#2  _interp_exec (interp=interp@entry=0x555555ad1f18 <_PyRuntime+88952>, code_arg=<optimized out>,
    shared_arg=0x7ffff7a186c0, p_excinfo=p_excinfo@entry=0x7fffffffd820, self=<optimized out>)
    at ./Modules/_interpretersmodule.c:955
#3  0x00007ffff79db9b0 in interp_exec (self=<optimized out>, args=<optimized out>, kwds=<optimized out>)
    at ./Modules/_interpretersmodule.c:1000
#4  0x00005555556abb43 in cfunction_call (func=0x7ffff7a6d9e0, args=<optimized out>,
    kwargs=<optimized out>) at Objects/methodobject.c:551
#5  0x0000555555643350 in _PyObject_MakeTpCall (tstate=0x555555b08c10 <_PyRuntime+313456>,
    callable=callable@entry=0x7ffff7a6d9e0, args=args@entry=0x7ffff7fb0080, nargs=<optimized out>,
    keywords=keywords@entry=0x0) at Objects/call.c:242
#6  0x0000555555643c76 in _PyObject_VectorcallTstate (kwnames=0x0, nargsf=<optimized out>,
    args=0x7ffff7fb0080, callable=0x7ffff7a6d9e0, tstate=<optimized out>)
    at ./Include/internal/pycore_call.h:165
#7  0x00005555555d8e75 in _PyEval_EvalFrameDefault (tstate=0x555555b08c10 <_PyRuntime+313456>,
    frame=0x7ffff7fb0020, throwflag=<optimized out>) at Python/generated_cases.c.h:955
#8  0x00005555557a559c in _PyEval_EvalFrame (throwflag=0, frame=0x7ffff7fb0020,
    tstate=0x555555b08c10 <_PyRuntime+313456>) at ./Include/internal/pycore_ceval.h:116
#9  _PyEval_Vector (args=0x0, argcount=0, kwnames=0x0, locals=0x7ffff7a18680, func=0x7ffff7a033d0,
    tstate=0x555555b08c10 <_PyRuntime+313456>) at Python/ceval.c:1898
#10 PyEval_EvalCode (co=co@entry=0x7ffff7a32230, globals=globals@entry=0x7ffff7a18680,
    locals=locals@entry=0x7ffff7a18680) at Python/ceval.c:659

The abort message is:

python: ./Modules/_interpretersmodule.c:462: _run_in_interpreter: Assertion `!PyErr_Occurred()' failed.
Aborted

Related to #126654.
Found using fusil by @vstinner.

CPython versions tested on:

3.13, 3.14, CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.14.0a2+ (heads/main:3c770e3f097, Nov 22 2024, 09:48:39) [GCC 11.4.0]

Linked PRs
@devdanzin devdanzin added the type-crash A hard crash of the interpreter, possibly with a core dump label Nov 23, 2024
@ZeroIntensity ZeroIntensity added extension-modules C modules in the Modules dir topic-subinterpreters 3.13 bugs and security fixes 3.14 bugs and security fixes labels Nov 23, 2024
@sobolevn sobolevn self-assigned this Nov 23, 2024
@ZeroIntensity
Copy link
Member

I think we just need to fix the assumption that _PyXI_Enter always successfully switches to the interpreter. I'll leave the patch to @sobolevn :)

sobolevn added a commit to sobolevn/cpython that referenced this issue Nov 24, 2024
@sobolevn
pythongh-127196: Fix crash in _interpreters, when shared had inva…
72b9e97 
…lid encodings
@bedevere-app bedevere-app bot mentioned this issue Nov 24, 2024
Merged
@github-actions github-actions bot mentioned this issue Dec 1, 2024
Closed
sobolevn added a commit that referenced this issue Jan 9, 2025
@sobolevn
gh-127196: Fix crash in _interpreters, when shared had invalid en…
087bb48 
…codings (#127220)
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Jan 9, 2025
@sobolevn @miss-islington
pythongh-127196: Fix crash in _interpreters, when shared had inva…
da3aba9 
…lid encodings (pythonGH-127220)

(cherry picked from commit 087bb48)

Co-authored-by: sobolevn <[email protected]>
@bedevere-app bedevere-app bot mentioned this issue Jan 9, 2025
Merged
sobolevn added a commit that referenced this issue Jan 9, 2025
@miss-islington @sobolevn
[3.13] gh-127196: Fix crash in _interpreters, when shared had inv…
0d2b9ab 
…alid encodings (GH-127220) (#128689)

gh-127196: Fix crash in `_interpreters`, when `shared` had invalid encodings (GH-127220)
(cherry picked from commit 087bb48)

Co-authored-by: sobolevn <[email protected]>
@sobolevn sobolevn closed this as completed Jan 9, 2025
@github-project-automation github-project-automation bot moved this from Todo to Done in Subinterpreters Jan 9, 2025
@ZeroIntensity
Copy link
Member

Thank you @devdanzin for the report!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@sobolevn sobolevn

Labels
3.13 bugs and security fixes 3.14 bugs and security fixes extension-modules C modules in the Modules dir topic-subinterpreters type-crash A hard crash of the interpreter, possibly with a core dump
Projects
Subinterpreters
Status: Done
Milestone
No milestone
Development

No branches or pull requests
3 participants
@sobolevn @ZeroIntensity @devdanzin