New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
New generator frames have a dangling previous pointer
#97752
Labels
3.11
3.12
interpreter-core
(Objects, Python, Grammar, and Parser dirs)
release-blocker
sprint
type-crash
A hard crash of the interpreter, possibly with a core dump
Comments
|
CC @markshannon |
markshannon
pushed a commit
that referenced
this issue
Oct 3, 2022
miss-islington
pushed a commit
to miss-islington/cpython
that referenced
this issue
Oct 3, 2022
…r/coroutine frames (pythonGH-97795) (cherry picked from commit 93fcc1f) Co-authored-by: Brandt Bucher <brandtbucher@microsoft.com>
brandtbucher
pushed a commit
that referenced
this issue
Oct 4, 2022
|
@brandtbucher Since gh-97812 is merged, can this issue be closed or have its |
|
I'd prefer to leave it open, and let @pablogsal close it once the cherry-pick to 3.11.0 is finished. |
|
@pablogsal This issue seems to be eligible for closing (see the comment above). |
pablogsal
pushed a commit
that referenced
this issue
Oct 22, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
3.11
3.12
interpreter-core
(Objects, Python, Grammar, and Parser dirs)
release-blocker
sprint
type-crash
A hard crash of the interpreter, possibly with a core dump


brandtbucher commentedOct 3, 2022
After
RETURN_GENERATORexecutes, the new generator's_PyInterpreterFramehas apreviousmember that still points to the caller's_PyInterpreterFrame. However, this is incorrect; it should beNULL, since the generator's frame isn't actually running anymore. This dangling pointer is dangerous, and can lead to hard crashes of the interpreter. Example:This should be
None, but instead it refers to a dead_PyInterpreterFramefrom the previous call:Making other calls "updates" this frame, since it just points to an arbitrary location in the stack:
It's also quite simple to corrupt:
This bug also appears to affect
PyAsyncGen_New,PyCoro_New,PyGen_New, andPyGen_NewWithQualName.The fix is simple: set
frame->previoustoNULLafter calls to_PyFrame_Copy. I'll open a PR at the sprint tomorrow.The text was updated successfully, but these errors were encountered: