From f83907c2e6b9177254e80dbf283f9b86746530b3 Mon Sep 17 00:00:00 2001 From: Nico-Posada Date: Fri, 16 May 2025 17:20:18 -0400 Subject: [PATCH 1/6] decref to_return after using it --- Python/import.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Python/import.c b/Python/import.c index 9dec0f488a3b90..e7be1b90751a6c 100644 --- a/Python/import.c +++ b/Python/import.c @@ -3854,15 +3854,17 @@ PyImport_ImportModuleLevelObject(PyObject *name, PyObject *globals, } final_mod = import_get_module(tstate, to_return); - Py_DECREF(to_return); if (final_mod == NULL) { if (!_PyErr_Occurred(tstate)) { _PyErr_Format(tstate, PyExc_KeyError, "%R not in sys.modules as expected", to_return); } + Py_DECREF(to_return); goto error; } + + Py_DECREF(to_return); } } else { From c405f2962e69099bceb443c70428e42fbe69a529 Mon Sep 17 00:00:00 2001 From: Nico-Posada Date: Fri, 16 May 2025 17:26:08 -0400 Subject: [PATCH 2/6] add blurb --- .../2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst b/Misc/NEWS.d/next/Core_and_Builtins/2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst new file mode 100644 index 00000000000000..7ca60786c8cf2d --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst @@ -0,0 +1,2 @@ +Fixed a use-after-free bug that would occur when an imported module wasn't +in sys.modules after the initial import. Patch by Nico-Posada. From d8965b4d9b97dba0b088edd66ab84165b6043737 Mon Sep 17 00:00:00 2001 From: Nico-Posada Date: Fri, 16 May 2025 18:27:40 -0400 Subject: [PATCH 3/6] add test case --- Lib/test/test_importlib/import_/test_relative_imports.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/Lib/test/test_importlib/import_/test_relative_imports.py b/Lib/test/test_importlib/import_/test_relative_imports.py index e535d119763148..90f9a62b9d7992 100644 --- a/Lib/test/test_importlib/import_/test_relative_imports.py +++ b/Lib/test/test_importlib/import_/test_relative_imports.py @@ -223,6 +223,14 @@ def test_relative_import_no_package_exists_absolute(self): self.__import__('sys', {'__package__': '', '__spec__': None}, level=1) + def test_malicious_relative_import(self): + # testing for gh-134100 + import sys + loooong = "".ljust(0x23000, "b") + sys.modules.update({f"a.{loooong}.c": {}}) + with self.assertRaisesRegex(KeyError, r"'a\.b+' not in sys\.modules as expected"): + __import__(f"{loooong}.c", {"__package__": "a"}, level=1) + (Frozen_RelativeImports, Source_RelativeImports From 0a93ff5545569e5f5ca18c5c495ce17d12c593ce Mon Sep 17 00:00:00 2001 From: Nico-Posada Date: Fri, 16 May 2025 18:28:59 -0400 Subject: [PATCH 4/6] fix news entry --- .../2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst b/Misc/NEWS.d/next/Core_and_Builtins/2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst index 7ca60786c8cf2d..ce7811ebbeed9e 100644 --- a/Misc/NEWS.d/next/Core_and_Builtins/2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst +++ b/Misc/NEWS.d/next/Core_and_Builtins/2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst @@ -1,2 +1,2 @@ Fixed a use-after-free bug that would occur when an imported module wasn't -in sys.modules after the initial import. Patch by Nico-Posada. +in :data:`sys.modules` after the initial import. Patch by Nico-Posada. From d9feb830f3f3481add51d95807d07af53e1daed0 Mon Sep 17 00:00:00 2001 From: Nico-Posada Date: Fri, 16 May 2025 19:24:31 -0400 Subject: [PATCH 5/6] fix testcase --- Lib/test/test_importlib/import_/test_relative_imports.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/Lib/test/test_importlib/import_/test_relative_imports.py b/Lib/test/test_importlib/import_/test_relative_imports.py index 90f9a62b9d7992..6353bfa3fda702 100644 --- a/Lib/test/test_importlib/import_/test_relative_imports.py +++ b/Lib/test/test_importlib/import_/test_relative_imports.py @@ -227,9 +227,12 @@ def test_malicious_relative_import(self): # testing for gh-134100 import sys loooong = "".ljust(0x23000, "b") - sys.modules.update({f"a.{loooong}.c": {}}) - with self.assertRaisesRegex(KeyError, r"'a\.b+' not in sys\.modules as expected"): - __import__(f"{loooong}.c", {"__package__": "a"}, level=1) + name = f"a.{loooong}.c" + + with util.uncache(name): + sys.modules[name] = {} + with self.assertRaisesRegex(KeyError, r"'a\.b+' not in sys\.modules as expected"): + __import__(f"{loooong}.c", {"__package__": "a"}, level=1) (Frozen_RelativeImports, From 6dbd9ae0763ee57d8730b900cc2f2011df72f9e0 Mon Sep 17 00:00:00 2001 From: Nico-Posada Date: Sat, 17 May 2025 10:57:51 -0400 Subject: [PATCH 6/6] code review changes --- Lib/test/test_importlib/import_/test_relative_imports.py | 8 ++++++-- .../2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst | 4 ++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/Lib/test/test_importlib/import_/test_relative_imports.py b/Lib/test/test_importlib/import_/test_relative_imports.py index 6353bfa3fda702..1549cbe96ce2d1 100644 --- a/Lib/test/test_importlib/import_/test_relative_imports.py +++ b/Lib/test/test_importlib/import_/test_relative_imports.py @@ -224,14 +224,18 @@ def test_relative_import_no_package_exists_absolute(self): level=1) def test_malicious_relative_import(self): - # testing for gh-134100 + # https://github.com/python/cpython/issues/134100 + # Test to make sure UAF bug with error msg doesn't come back to life import sys loooong = "".ljust(0x23000, "b") name = f"a.{loooong}.c" with util.uncache(name): sys.modules[name] = {} - with self.assertRaisesRegex(KeyError, r"'a\.b+' not in sys\.modules as expected"): + with self.assertRaisesRegex( + KeyError, + r"'a\.b+' not in sys\.modules as expected" + ): __import__(f"{loooong}.c", {"__package__": "a"}, level=1) diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst b/Misc/NEWS.d/next/Core_and_Builtins/2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst index ce7811ebbeed9e..d672347f9ad246 100644 --- a/Misc/NEWS.d/next/Core_and_Builtins/2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst +++ b/Misc/NEWS.d/next/Core_and_Builtins/2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst @@ -1,2 +1,2 @@ -Fixed a use-after-free bug that would occur when an imported module wasn't -in :data:`sys.modules` after the initial import. Patch by Nico-Posada. +Fix a use-after-free bug that occurs when an imported module isn't +in :data:`sys.modules` after its initial import. Patch by Nico-Posada.