Thanks to visit codestin.com
Credit goes to github.com

Skip to content

gh-142555: Fix null pointer dereference in array.__setitem__ via re-entrant __index__ #142713

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
encukou merged 22 commits into from
Feb 2, 2026
Merged

gh-142555: Fix null pointer dereference in array.__setitem__ via re-entrant __index__ #142713

Changes from 1 commit
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
71fc725
Fix null pointer dereference in array.__setitem__ via re-entrant __in…
aisk Dec 14, 2025
6c437d5
Update Misc/NEWS.d/next/Core_and_Builtins/2025-12-15-02-02-45.gh-issu…
aisk Dec 15, 2025
e3c728a
Move the news entry to library folder
aisk Dec 15, 2025
67e98b5
Also check if the ob_item's size is changed by user's code
aisk Dec 17, 2025
ad18d48
Add check on more *_setitem methods
aisk Dec 17, 2025
c408c57
Check other setitem methods
aisk Dec 18, 2025
95e4eec
Reduce the comments
aisk Dec 18, 2025
fc6f987
Re-order the test
aisk Dec 18, 2025
c8cbd28
Refactor the array check codes to a function
aisk Dec 19, 2025
0b3db3c
Change the bound check from function to macro
aisk Dec 20, 2025
8eeba89
Revert the format changed made by IDE automatically
aisk Dec 20, 2025
e00b7a4
Revert more format changes
aisk Dec 20, 2025
2b6d5dc
Revert more format changes
aisk Dec 20, 2025
c83b64a
Revert more format test
aisk Dec 20, 2025
d0ff678
Update news entry
aisk Dec 20, 2025
e865d0d
Update Misc/NEWS.d/next/Library/2025-12-15-02-02-45.gh-issue-142555.E…
aisk Dec 27, 2025
0ad0f28
Refactor tests
aisk Dec 27, 2025
b3617c8
Format the macro by PEP7
aisk Dec 27, 2025
deccbf0
Update by review comments
aisk Dec 27, 2025
a4dab68
Simplify the test
aisk Dec 27, 2025
1befa98
Update comment
aisk Dec 27, 2025
37ed8f8
Update Lib/test/test_array.py
aisk Dec 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Refactor tests
  • Loading branch information
@aisk
aisk committed Dec 27, 2025
commit 0ad0f2877cd783c00d6eb51c598634a621aaf575
110 changes: 54 additions & 56 deletions Lib/test/test_array.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
from test.support import import_helper
from test.support import os_helper
from test.support import _2G
from test.support import subTests
import weakref
import pickle
import operator
Expand Down Expand Up @@ -1680,63 +1681,60 @@ def test_gh_128961(self):
it.__setstate__(0)
self.assertRaises(StopIteration, next, it)

def test_array_validity_after_call_user_method(self):
@subTests(
("dtype", "items"),
[
("b", [0] * 64),
("B", [1, 2, 3]),
Comment thread
aisk marked this conversation as resolved.
Outdated
("h", [1, 2, 3]),
("H", [1, 2, 3]),
("i", [1, 2, 3]),
("l", [1, 2, 3]),
("q", [1, 2, 3]),
("I", [1, 2, 3]),
("L", [1, 2, 3]),
("Q", [1, 2, 3]),
],
)
def test_setitem_use_after_clear_with_int_data(self, dtype, items):
# gh-142555: Test for null pointer dereference in array.__setitem__
# via re-entrant __index__ or __float__.

def test_clear_array(victim):
class EvilIndex:
def __index__(self):
# Re-entrant mutation: clear the array while __setitem__
# still holds a pointer to the pre-clear buffer.
victim.clear()
return 0

with self.assertRaises(IndexError):
victim[1] = EvilIndex()

self.assertEqual(len(victim), 0)

def test_shrink_array(victim):
class ShrinkIndex:
def __index__(self):
# Re-entrant mutation: change the array size while
# __setitem__ still keep the original size.
victim.pop()
victim.pop()
return 0

with self.assertRaises(IndexError):
victim[1] = ShrinkIndex()

test_clear_array(array.array('b', [0] * 64))
test_shrink_array(array.array('b', [1, 2, 3]))
test_clear_array(array.array('B', [1, 2, 3]))
test_clear_array(array.array('h', [1, 2, 3]))
test_clear_array(array.array('H', [1, 2, 3]))
test_clear_array(array.array('i', [1, 2, 3]))
test_clear_array(array.array('l', [1, 2, 3]))
test_clear_array(array.array('q', [1, 2, 3]))
test_clear_array(array.array('I', [1, 2, 3]))
test_clear_array(array.array('L', [1, 2, 3]))
test_clear_array(array.array('Q', [1, 2, 3]))

def test_clear_array_float(victim):
"""Test array clearing scenario using __float__ method"""
class EvilFloat:
def __float__(self):
# Re-entrant mutation: clear the array while __setitem__
# still holds a pointer to the pre-clear buffer.
victim.clear()
return 0.0

with self.assertRaises(IndexError):
victim[1] = EvilFloat()

self.assertEqual(len(victim), 0)

test_clear_array_float(array.array('f', [1.0, 2.0, 3.0]))
test_clear_array_float(array.array('d', [1.0, 2.0, 3.0]))
# via re-entrant __index__ that clears the array.
victim = array.array(dtype, items)

class Index:
def __index__(self):
victim.clear()
return 0

self.assertRaises(IndexError, victim.__setitem__, 1, Index())
self.assertEqual(len(victim), 0)

def test_setitem_use_after_shrink_with_int_data(self):
# gh-142555: Test for null pointer dereference in array.__setitem__
# via re-entrant __index__ that shrinks the array.
victim = array.array('b', [1, 2, 3])

class Index:
def __index__(self):
victim.pop()
victim.pop()
return 0

self.assertRaises(IndexError, victim.__setitem__, 1, Index())

@subTests("dtype", ["f", "d"])
def test_setitem_use_after_clear_with_float_data(self, dtype):
# gh-142555: Test for null pointer dereference in array.__setitem__
# via re-entrant __float__ that clears the array.
victim = array.array(dtype, [1.0, 2.0, 3.0])

class Float:
def __float__(self):
victim.clear()
return 0.0

self.assertRaises(IndexError, victim.__setitem__, 1, Float())
self.assertEqual(len(victim), 0)


if __name__ == "__main__":
Expand Down