Skip to content

io.TextIOWrapper UAF triggered by readline() #157364

Closed
Closed
io.TextIOWrapper UAF triggered by readline()#157364
Labels
3.14bugs and security fixes3.15bugs and security fixesextension-modulesC modules in the Modules dirtopic-IOtype-bugAn unexpected behavior, bug, or error

Description

@djarfluka
djarfluka
opened on Sep 12, 2026

Bug report

Bug description:

import io
class R(io.RawIOBase):
    def readable(self): return True
    def readinto(self,b):
        tw.detach(); b[:3]=b"ab\n"; return 3
tw=io.TextIOWrapper(io.BufferedReader(R()),encoding="utf-8")
tw.readline(); 
Exception ignored while finalizing file <_io.BufferedReader>:
Traceback (most recent call last):
  File "/repro/audit4/repro/textio_detach_uaf_readline.py", line 5, in readinto
    tw.detach(); b[:3]=b"ab\n"; return 3
    ~~~~~~~~~^^
RuntimeError: reentrant call inside <_io.BufferedReader>
=================================================================
==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x50f000038a20 at pc 0xaaaacdacc864 bp 0xffffd28429c0 sp 0xffffd28429b0
READ of size 8 at 0x50f000038a20 thread T0
    #0 0xaaaacdacc860 in _bufferedreader_raw_read Modules/_io/bufferedio.c:1667
    #1 0xaaaacdad17c0 in _io__Buffered_read1_impl Modules/_io/bufferedio.c:1080
    #2 0xaaaacdad17c0 in _io__Buffered_read1 Modules/_io/clinic/bufferedio.c.h:721
    #3 0xaaaacd059b50 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #4 0xaaaacd059b50 in PyObject_VectorcallMethod Objects/call.c:921
    #5 0xaaaacdadbd48 in PyObject_CallMethodOneArg Include/cpython/abstract.h:74
    #6 0xaaaacdadbd48 in buffer_callmethod_onearg Modules/_io/textio.c:792
    #7 0xaaaacdaf42f8 in textiowrapper_read_chunk Modules/_io/textio.c:1996
    #8 0xaaaacdaf8508 in _textiowrapper_readline Modules/_io/textio.c:2307
    #9 0xaaaacd056320 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #10 0xaaaacd056320 in PyObject_Vectorcall Objects/call.c:327
    #11 0xaaaacd6a1bc8 in _Py_VectorCallInstrumentation_StackRefSteal Python/ceval.c:768
    #12 0xaaaaccdd1de8 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1906
    #13 0xaaaacd6c0b1c in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
    #14 0xaaaacd6c0b1c in _PyEval_Vector Python/ceval.c:2174
    #15 0xaaaacd6c0b1c in PyEval_EvalCode Python/ceval.c:679
    #16 0xaaaacd8bfeb4 in run_mod Python/pythonrun.c:1509
    #17 0xaaaacd8c0d38 in _PyRun_File Python/pythonrun.c:1332
    #18 0xaaaacd8c4ffc in _PyRun_SimpleFile Python/pythonrun.c:544
    #19 0xaaaacd8c8dd0 in _PyRun_AnyFile Python/pythonrun.c:92
    #20 0xaaaacd99390c in pymain_run_file_obj Modules/main.c:478
    #21 0xaaaacd99390c in pymain_run_file Modules/main.c:494
    #22 0xaaaacd99390c in pymain_run_python Modules/main.c:804
    #23 0xaaaacd99390c in Py_RunMain Modules/main.c:891
    #24 0xaaaacd995c38 in pymain_main Modules/main.c:921
    #25 0xaaaacd995c38 in Py_BytesMain Modules/main.c:945
    #26 0xffff8b8f84c0  (/lib/aarch64-linux-gnu/libc.so.6+0x284c0) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #27 0xffff8b8f8594 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28594) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #28 0xaaaacce3beec in _start (/src/cpython/python+0x183beec) (BuildId: eba909a3db0adabacf151d7dc3081dda7999191a)

0x50f000038a20 is located 64 bytes inside of 168-byte region [0x50f0000389e0,0x50f000038a88)
freed by thread T0 here:
    #0 0xffff8c2961b4 in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
    #1 0xaaaacdabd8dc in buffered_dealloc Modules/_io/bufferedio.c:444
    #2 0xaaaacd247ab0 in _Py_Dealloc Objects/object.c:3334
    #3 0xaaaaccdffea0 in Py_DECREF_MORTAL Include/internal/pycore_object.h:449
    #4 0xaaaaccdffea0 in PyStackRef_XCLOSE Include/internal/pycore_stackref.h:726
    #5 0xaaaaccdffea0 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:11163
    #6 0xaaaacd6c1a00 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
    #7 0xaaaacd6c1a00 in _PyEval_Vector Python/ceval.c:2174
    #8 0xaaaacd059b50 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #9 0xaaaacd059b50 in PyObject_VectorcallMethod Objects/call.c:921
    #10 0xaaaacdacc2d8 in PyObject_CallMethodOneArg Include/cpython/abstract.h:74
    #11 0xaaaacdacc2d8 in _bufferedreader_raw_read Modules/_io/bufferedio.c:1640
    #12 0xaaaacdad17c0 in _io__Buffered_read1_impl Modules/_io/bufferedio.c:1080
    #13 0xaaaacdad17c0 in _io__Buffered_read1 Modules/_io/clinic/bufferedio.c.h:721
    #14 0xaaaacd059b50 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #15 0xaaaacd059b50 in PyObject_VectorcallMethod Objects/call.c:921
    #16 0xaaaacdadbd48 in PyObject_CallMethodOneArg Include/cpython/abstract.h:74
    #17 0xaaaacdadbd48 in buffer_callmethod_onearg Modules/_io/textio.c:792
    #18 0xaaaacdaf42f8 in textiowrapper_read_chunk Modules/_io/textio.c:1996
    #19 0xaaaacdaf8508 in _textiowrapper_readline Modules/_io/textio.c:2307
    #20 0xaaaacd056320 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #21 0xaaaacd056320 in PyObject_Vectorcall Objects/call.c:327
    #22 0xaaaacd6a1bc8 in _Py_VectorCallInstrumentation_StackRefSteal Python/ceval.c:768
    #23 0xaaaaccdd1de8 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1906
    #24 0xaaaacd6c0b1c in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
    #25 0xaaaacd6c0b1c in _PyEval_Vector Python/ceval.c:2174
    #26 0xaaaacd6c0b1c in PyEval_EvalCode Python/ceval.c:679
    #27 0xaaaacd8bfeb4 in run_mod Python/pythonrun.c:1509
    #28 0xaaaacd8c0d38 in _PyRun_File Python/pythonrun.c:1332
    #29 0xaaaacd8c4ffc in _PyRun_SimpleFile Python/pythonrun.c:544
    #30 0xaaaacd8c8dd0 in _PyRun_AnyFile Python/pythonrun.c:92
    #31 0xaaaacd99390c in pymain_run_file_obj Modules/main.c:478
    #32 0xaaaacd99390c in pymain_run_file Modules/main.c:494
    #33 0xaaaacd99390c in pymain_run_python Modules/main.c:804
    #34 0xaaaacd99390c in Py_RunMain Modules/main.c:891
    #35 0xaaaacd995c38 in pymain_main Modules/main.c:921
    #36 0xaaaacd995c38 in Py_BytesMain Modules/main.c:945
    #37 0xffff8b8f84c0  (/lib/aarch64-linux-gnu/libc.so.6+0x284c0) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #38 0xffff8b8f8594 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28594) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #39 0xaaaacce3beec in _start (/src/cpython/python+0x183beec) (BuildId: eba909a3db0adabacf151d7dc3081dda7999191a)

previously allocated by thread T0 here:
    #0 0xffff8c2976d0 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0xaaaacd36077c in _PyObject_MallocWithType Include/internal/pycore_object_alloc.h:46
    #2 0xaaaacd36077c in _PyType_AllocNoTrack Objects/typeobject.c:2498
    #3 0xaaaacd360e00 in PyType_GenericAlloc Objects/typeobject.c:2529
    #4 0xaaaacd366808 in type_call Objects/typeobject.c:2442
    #5 0xaaaacd054250 in _PyObject_MakeTpCall Objects/call.c:242
    #6 0xaaaacd6a1bc8 in _Py_VectorCallInstrumentation_StackRefSteal Python/ceval.c:768
    #7 0xaaaaccdd1de8 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1906
    #8 0xaaaacd6c0b1c in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
    #9 0xaaaacd6c0b1c in _PyEval_Vector Python/ceval.c:2174
    #10 0xaaaacd6c0b1c in PyEval_EvalCode Python/ceval.c:679
    #11 0xaaaacd8bfeb4 in run_mod Python/pythonrun.c:1509
    #12 0xaaaacd8c0d38 in _PyRun_File Python/pythonrun.c:1332
    #13 0xaaaacd8c4ffc in _PyRun_SimpleFile Python/pythonrun.c:544
    #14 0xaaaacd8c8dd0 in _PyRun_AnyFile Python/pythonrun.c:92
    #15 0xaaaacd99390c in pymain_run_file_obj Modules/main.c:478
    #16 0xaaaacd99390c in pymain_run_file Modules/main.c:494
    #17 0xaaaacd99390c in pymain_run_python Modules/main.c:804
    #18 0xaaaacd99390c in Py_RunMain Modules/main.c:891
    #19 0xaaaacd995c38 in pymain_main Modules/main.c:921
    #20 0xaaaacd995c38 in Py_BytesMain Modules/main.c:945
    #21 0xffff8b8f84c0  (/lib/aarch64-linux-gnu/libc.so.6+0x284c0) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #22 0xffff8b8f8594 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28594) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #23 0xaaaacce3beec in _start (/src/cpython/python+0x183beec) (BuildId: eba909a3db0adabacf151d7dc3081dda7999191a)

SUMMARY: AddressSanitizer: heap-use-after-free Modules/_io/bufferedio.c:1667 in _bufferedreader_raw_read
Shadow bytes around the buggy address:
  0x50f000038780: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
  0x50f000038800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x50f000038880: 00 00 00 00 00 fa fa fa fa fa fa fa fa fa 00 00
  0x50f000038900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x50f000038980: 00 00 00 fa fa fa fa fa fa fa fa fa fd fd fd fd
=>0x50f000038a00: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
  0x50f000038a80: fd fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd
  0x50f000038b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x50f000038b80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x50f000038c00: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
  0x50f000038c80: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1==ABORTING

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

Activity

  1. djarfluka
    added
    type-bugAn unexpected behavior, bug, or error
    on Sep 12, 2026

  2. djarfluka commented on Sep 12, 2026

    @djarfluka
    djarfluka
    on Sep 12, 2026
    Author

    Related to #157363 but different error site

  3. StanFromIreland
    added
    extension-modulesC modules in the Modules dir
    topic-free-threading
    on Sep 12, 2026

  4. picnixz commented on Sep 12, 2026

    @picnixz
    picnixz
    on Sep 12, 2026
    Member

    So there is a runtime error but we still have an UAF

  5. ashm-dev commented on Sep 12, 2026

    @ashm-dev
    ashm-dev
    on Sep 12, 2026
    Contributor

    In my repro under debug/ASan it goes even further: after _bufferedreader_raw_read returns, _io__Buffered_read1_impl crashes at LEAVE_BUFFERED(self) because self->lock is already dead (0xdd poisoned).

    Just wrapping raw_read in Py_INCREF/Py_DECREF is a fragile band-aid that only masks the symptom.

    This should be fixed at a higher level:

    1. detach() must not release/clear the underlying buffer if it is actively locked in a reentrant call.
    2. Or buffered_dealloc must not free the object/lock while it is currently acquired by the active thread.

  6. ashm-dev commented on Sep 12, 2026

    @ashm-dev
    ashm-dev
    on Sep 12, 2026
    Contributor

    @picnixz Also reproduced on default (GIL) build

    CC=clang CXX=clang++ LDFLAGS='-fuse-ld=lld' ./configure --with-pydebug --with-address-sanitizer --with-undefined-behavior-sanitize


    ❯ ./python -X dev bug.py
Exception ignored while finalizing file <_io.BufferedReader>:
Traceback (most recent call last):
  File "/home/boss/projects/oss/cpython/main/bug.py", line 9, in readinto
    tw.detach()
    ~~~~~~~~~^^
RuntimeError: reentrant call inside <_io.BufferedReader>
=================================================================
==176750==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c9219425e90 at pc 0x55ceaec695c0 bp 0x7ffd8e863290 sp 0x7ffd8e863288
READ of size 8 at 0x7c9219425e90 thread T0
    #0 0x55ceaec695bf in _bufferedreader_raw_read /home/boss/projects/oss/cpython/main/./Modules/_io/bufferedio.c:1667:24
    #1 0x55ceaec70821 in _io__Buffered_read1_impl /home/boss/projects/oss/cpython/main/./Modules/_io/bufferedio.c:1080:20
    #2 0x55ceaec70821 in _io__Buffered_read1 /home/boss/projects/oss/cpython/main/./Modules/_io/clinic/bufferedio.c.h:721:20
    #3 0x55ceae2253bd in method_vectorcall_FASTCALL /home/boss/projects/oss/cpython/main/Objects/descrobject.c:402:24
    #4 0x55ceae1e0015 in _PyObject_VectorcallTstate /home/boss/projects/oss/cpython/main/./Include/internal/pycore_call.h:144:11
    #5 0x55ceae1e7119 in PyObject_VectorcallMethod /home/boss/projects/oss/cpython/main/Objects/call.c
    #6 0x55ceaec98362 in PyObject_CallMethodOneArg /home/boss/projects/oss/cpython/main/./Include/cpython/abstract.h:74:12
    #7 0x55ceaec98362 in buffer_callmethod_onearg /home/boss/projects/oss/cpython/main/./Modules/_io/textio.c:792:12
    #8 0x55ceaec98362 in textiowrapper_read_chunk /home/boss/projects/oss/cpython/main/./Modules/_io/textio.c:1996:19
    #9 0x55ceaec95a83 in _textiowrapper_readline /home/boss/projects/oss/cpython/main/./Modules/_io/textio.c:2307:19
    #10 0x55ceae2253bd in method_vectorcall_FASTCALL /home/boss/projects/oss/cpython/main/Objects/descrobject.c:402:24
    #11 0x55ceae1e0015 in _PyObject_VectorcallTstate /home/boss/projects/oss/cpython/main/./Include/internal/pycore_call.h:144:11
    #12 0x55ceae7347b0 in _Py_VectorCallInstrumentation_StackRefSteal /home/boss/projects/oss/cpython/main/Python/ceval.c:770:11
    #13 0x55ceae789be1 in _PyEval_EvalFrameDefault /home/boss/projects/oss/cpython/main/Python/generated_cases.c.h:1906:35
    #14 0x55ceae733500 in _PyEval_Vector /home/boss/projects/oss/cpython/main/Python/ceval.c:2176:12
    #15 0x55ceae733500 in PyEval_EvalCode /home/boss/projects/oss/cpython/main/Python/ceval.c:681:21
    #16 0x55ceaea8600a in run_eval_code_obj /home/boss/projects/oss/cpython/main/Python/pythonrun.c:1406:12
    #17 0x55ceaea85731 in run_mod /home/boss/projects/oss/cpython/main/Python/pythonrun.c:1509:19
    #18 0x55ceaea8023f in _PyRun_File /home/boss/projects/oss/cpython/main/Python/pythonrun.c:1332:15
    #19 0x55ceaea7e484 in _PyRun_SimpleFile /home/boss/projects/oss/cpython/main/Python/pythonrun.c:544:15
    #20 0x55ceaea7da5c in _PyRun_AnyFile /home/boss/projects/oss/cpython/main/Python/pythonrun.c:92:18
    #21 0x55ceaeb477df in pymain_run_file_obj /home/boss/projects/oss/cpython/main/Modules/main.c:478:24
    #22 0x55ceaeb477df in pymain_run_file /home/boss/projects/oss/cpython/main/Modules/main.c:494:20
    #23 0x55ceaeb45ecf in pymain_run_python /home/boss/projects/oss/cpython/main/Modules/main.c:804:21
    #24 0x55ceaeb45ecf in Py_RunMain /home/boss/projects/oss/cpython/main/Modules/main.c:891:5
    #25 0x55ceaeb46f1f in pymain_main /home/boss/projects/oss/cpython/main/Modules/main.c:921:12
    #26 0x55ceaeb471ac in Py_BytesMain /home/boss/projects/oss/cpython/main/Modules/main.c:945:12
    #27 0x7f921a027780  (/usr/lib/libc.so.6+0x27780) (BuildId: 503200d7fda94a5dc6058d7e0694e5d1dcb2e372)
    #28 0x7f921a0278b8 in __libc_start_main (/usr/lib/libc.so.6+0x278b8) (BuildId: 503200d7fda94a5dc6058d7e0694e5d1dcb2e372)
    #29 0x55ceadc65ba4 in _start (/home/boss/projects/oss/cpython/main/python+0xd7fba4) (BuildId: e8f674f857eaf5155b065c373ade82343fe5b882)

0x7c9219425e90 is located 80 bytes inside of 192-byte region [0x7c9219425e40,0x7c9219425f00)
freed by thread T0 here:
    #0 0x55ceadd71ff1 in free.part.0 (/home/boss/projects/oss/cpython/main/python+0xe8bff1) (BuildId: e8f674f857eaf5155b065c373ade82343fe5b882)
    #1 0x55ceae403bb8 in _PyMem_DebugRawFree /home/boss/projects/oss/cpython/main/Objects/obmalloc.c:3171:5
    #2 0x55ceaec61815 in buffered_dealloc /home/boss/projects/oss/cpython/main/./Modules/_io/bufferedio.c:444:5
    #3 0x55ceae3c2a17 in _Py_Dealloc /home/boss/projects/oss/cpython/main/Objects/object.c:3334:5
    #4 0x55ceae75967a in PyStackRef_XCLOSE /home/boss/projects/oss/cpython/main/./Include/internal/pycore_stackref.h:726:9
    #5 0x55ceae75967a in _PyEval_EvalFrameDefault /home/boss/projects/oss/cpython/main/Python/generated_cases.c.h:11163:13
    #6 0x55ceae733a1d in _PyEval_Vector /home/boss/projects/oss/cpython/main/Python/ceval.c:2176:12
    #7 0x55ceae1e0015 in _PyObject_VectorcallTstate /home/boss/projects/oss/cpython/main/./Include/internal/pycore_call.h:144:11
    #8 0x55ceae1e7119 in PyObject_VectorcallMethod /home/boss/projects/oss/cpython/main/Objects/call.c
    #9 0x55ceaec690d2 in PyObject_CallMethodOneArg /home/boss/projects/oss/cpython/main/./Include/cpython/abstract.h:74:12
    #10 0x55ceaec690d2 in _bufferedreader_raw_read /home/boss/projects/oss/cpython/main/./Modules/_io/bufferedio.c:1640:15
    #11 0x55ceaec70821 in _io__Buffered_read1_impl /home/boss/projects/oss/cpython/main/./Modules/_io/bufferedio.c:1080:20
    #12 0x55ceaec70821 in _io__Buffered_read1 /home/boss/projects/oss/cpython/main/./Modules/_io/clinic/bufferedio.c.h:721:20
    #13 0x55ceae2253bd in method_vectorcall_FASTCALL /home/boss/projects/oss/cpython/main/Objects/descrobject.c:402:24
    #14 0x55ceae1e0015 in _PyObject_VectorcallTstate /home/boss/projects/oss/cpython/main/./Include/internal/pycore_call.h:144:11
    #15 0x55ceae1e7119 in PyObject_VectorcallMethod /home/boss/projects/oss/cpython/main/Objects/call.c
    #16 0x55ceaec98362 in PyObject_CallMethodOneArg /home/boss/projects/oss/cpython/main/./Include/cpython/abstract.h:74:12
    #17 0x55ceaec98362 in buffer_callmethod_onearg /home/boss/projects/oss/cpython/main/./Modules/_io/textio.c:792:12
    #18 0x55ceaec98362 in textiowrapper_read_chunk /home/boss/projects/oss/cpython/main/./Modules/_io/textio.c:1996:19
    #19 0x55ceaec95a83 in _textiowrapper_readline /home/boss/projects/oss/cpython/main/./Modules/_io/textio.c:2307:19
    #20 0x55ceae2253bd in method_vectorcall_FASTCALL /home/boss/projects/oss/cpython/main/Objects/descrobject.c:402:24
    #21 0x55ceae1e0015 in _PyObject_VectorcallTstate /home/boss/projects/oss/cpython/main/./Include/internal/pycore_call.h:144:11
    #22 0x55ceae7347b0 in _Py_VectorCallInstrumentation_StackRefSteal /home/boss/projects/oss/cpython/main/Python/ceval.c:770:11
    #23 0x55ceae789be1 in _PyEval_EvalFrameDefault /home/boss/projects/oss/cpython/main/Python/generated_cases.c.h:1906:35
    #24 0x55ceae733500 in _PyEval_Vector /home/boss/projects/oss/cpython/main/Python/ceval.c:2176:12
    #25 0x55ceae733500 in PyEval_EvalCode /home/boss/projects/oss/cpython/main/Python/ceval.c:681:21
    #26 0x55ceaea8600a in run_eval_code_obj /home/boss/projects/oss/cpython/main/Python/pythonrun.c:1406:12
    #27 0x55ceaea85731 in run_mod /home/boss/projects/oss/cpython/main/Python/pythonrun.c:1509:19
    #28 0x55ceaea8023f in _PyRun_File /home/boss/projects/oss/cpython/main/Python/pythonrun.c:1332:15
    #29 0x55ceaea7e484 in _PyRun_SimpleFile /home/boss/projects/oss/cpython/main/Python/pythonrun.c:544:15
    #30 0x55ceaea7da5c in _PyRun_AnyFile /home/boss/projects/oss/cpython/main/Python/pythonrun.c:92:18
    #31 0x55ceaeb477df in pymain_run_file_obj /home/boss/projects/oss/cpython/main/Modules/main.c:478:24
    #32 0x55ceaeb477df in pymain_run_file /home/boss/projects/oss/cpython/main/Modules/main.c:494:20
    #33 0x55ceaeb45ecf in pymain_run_python /home/boss/projects/oss/cpython/main/Modules/main.c:804:21
    #34 0x55ceaeb45ecf in Py_RunMain /home/boss/projects/oss/cpython/main/Modules/main.c:891:5
    #35 0x55ceaeb46f1f in pymain_main /home/boss/projects/oss/cpython/main/Modules/main.c:921:12
    #36 0x55ceaeb471ac in Py_BytesMain /home/boss/projects/oss/cpython/main/Modules/main.c:945:12
    #37 0x7f921a027780  (/usr/lib/libc.so.6+0x27780) (BuildId: 503200d7fda94a5dc6058d7e0694e5d1dcb2e372)

previously allocated by thread T0 here:
    #0 0x55ceadd72f91 in malloc (/home/boss/projects/oss/cpython/main/python+0xe8cf91) (BuildId: e8f674f857eaf5155b065c373ade82343fe5b882)
    #1 0x55ceae409b67 in _PyMem_DebugRawAlloc /home/boss/projects/oss/cpython/main/Objects/obmalloc.c:3103:24
    #2 0x55ceae471758 in _PyObject_MallocWithType /home/boss/projects/oss/cpython/main/./Include/internal/pycore_object_alloc.h:46:17
    #3 0x55ceae471758 in _PyType_AllocNoTrack /home/boss/projects/oss/cpython/main/Objects/typeobject.c:2498:19
    #4 0x55ceae47143d in PyType_GenericAlloc /home/boss/projects/oss/cpython/main/Objects/typeobject.c:2529:21
    #5 0x55ceae491199 in object_new /home/boss/projects/oss/cpython/main/Objects/typeobject.c:7355:21
    #6 0x55ceae488fe9 in type_call /home/boss/projects/oss/cpython/main/Objects/typeobject.c:2442:11
    #7 0x55ceae1e09d2 in _PyObject_MakeTpCall /home/boss/projects/oss/cpython/main/Objects/call.c:242:18
    #8 0x55ceae7347b0 in _Py_VectorCallInstrumentation_StackRefSteal /home/boss/projects/oss/cpython/main/Python/ceval.c:770:11
    #9 0x55ceae789be1 in _PyEval_EvalFrameDefault /home/boss/projects/oss/cpython/main/Python/generated_cases.c.h:1906:35
    #10 0x55ceae733500 in _PyEval_Vector /home/boss/projects/oss/cpython/main/Python/ceval.c:2176:12
    #11 0x55ceae733500 in PyEval_EvalCode /home/boss/projects/oss/cpython/main/Python/ceval.c:681:21
    #12 0x55ceaea8600a in run_eval_code_obj /home/boss/projects/oss/cpython/main/Python/pythonrun.c:1406:12
    #13 0x55ceaea85731 in run_mod /home/boss/projects/oss/cpython/main/Python/pythonrun.c:1509:19
    #14 0x55ceaea8023f in _PyRun_File /home/boss/projects/oss/cpython/main/Python/pythonrun.c:1332:15
    #15 0x55ceaea7e484 in _PyRun_SimpleFile /home/boss/projects/oss/cpython/main/Python/pythonrun.c:544:15
    #16 0x55ceaea7da5c in _PyRun_AnyFile /home/boss/projects/oss/cpython/main/Python/pythonrun.c:92:18
    #17 0x55ceaeb477df in pymain_run_file_obj /home/boss/projects/oss/cpython/main/Modules/main.c:478:24
    #18 0x55ceaeb477df in pymain_run_file /home/boss/projects/oss/cpython/main/Modules/main.c:494:20
    #19 0x55ceaeb45ecf in pymain_run_python /home/boss/projects/oss/cpython/main/Modules/main.c:804:21
    #20 0x55ceaeb45ecf in Py_RunMain /home/boss/projects/oss/cpython/main/Modules/main.c:891:5
    #21 0x55ceaeb46f1f in pymain_main /home/boss/projects/oss/cpython/main/Modules/main.c:921:12
    #22 0x55ceaeb471ac in Py_BytesMain /home/boss/projects/oss/cpython/main/Modules/main.c:945:12
    #23 0x7f921a027780  (/usr/lib/libc.so.6+0x27780) (BuildId: 503200d7fda94a5dc6058d7e0694e5d1dcb2e372)
    #24 0x7f921a0278b8 in __libc_start_main (/usr/lib/libc.so.6+0x278b8) (BuildId: 503200d7fda94a5dc6058d7e0694e5d1dcb2e372)
    #25 0x55ceadc65ba4 in _start (/home/boss/projects/oss/cpython/main/python+0xd7fba4) (BuildId: e8f674f857eaf5155b065c373ade82343fe5b882)

SUMMARY: AddressSanitizer: heap-use-after-free /home/boss/projects/oss/cpython/main/./Modules/_io/bufferedio.c:1667:24 in _bufferedreader_raw_read
Shadow bytes around the buggy address:
  0x7c9219425c00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x7c9219425c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c9219425d00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x7c9219425d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa
  0x7c9219425e00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x7c9219425e80: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7c9219425f00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x7c9219425f80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7c9219426000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x7c9219426080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7c9219426100: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==176750==ABORTING

  7. picnixz commented on Sep 12, 2026

    @picnixz
    picnixz
    on Sep 12, 2026
    Member

    @cmaloney @vstinner

  8. picnixz
    removed
    topic-free-threading
    on Sep 12, 2026
  9. ashm-dev
    added a commit that references this issue on Sep 12, 2026

    Merge branch 'main' into pythongh-157364

    05510fb

  10. ashm-dev commented on Sep 12, 2026

    @ashm-dev
    ashm-dev
    on Sep 12, 2026
    Contributor

    @picnixz Confirmed and reproduced on 3.14 and 3.15 (both GIL and free-threaded). Earlier branches (3.10–3.13) fail to build locally due to unrelated ASan/UBSan errors

  11. cmaloney
    added
    topic-IO
    on Sep 26, 2026
  12. vstinner
    added a commit that references this issue on Oct 7, 2026

    gh-157364: Fix use-after-free in io.TextIOWrapper during reentrant de…

    e19dc47
  13. cmaloney
    added
    3.14bugs and security fixes
    3.15bugs and security fixes
    on Oct 7, 2026
  14. vstinner
    closed this as completedon Oct 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.14bugs and security fixes3.15bugs and security fixesextension-modulesC modules in the Modules dirtopic-IOtype-bugAn unexpected behavior, bug, or error

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions