Skip to content

Check tokens[0] after allocating memory #95355

Closed
Closed
Check tokens[0] after allocating memory#95355
Labels
3.10 (EOL)end of life3.11only security fixes3.12only security fixestype-crashA hard crash of the interpreter, possibly with a core dump

Description

@imzhuhl
imzhuhl
opened on Jul 28, 2022

Bug report

I have questions when reading the source code of file pegen.c.
There is a code snippet in function _PyPegen_Parser_New:

p->tokens[0] = PyMem_Calloc(1, sizeof(Token));
if (!p->tokens) {
    PyMem_Free(p->tokens);
    PyMem_Free(p);
    return (Parser *) PyErr_NoMemory();
}

I think it makes more sense to check p->tokens[0] but not p->tokens in if condition.

I look at the PR #19669 where the code was introduced and no one discussed this. Is this an oversight, or am I wrong?

Your environment

  • CPython versions tested on: main branch

Activity

  1. imzhuhl
    added
    type-bugAn unexpected behavior, bug, or error
    on Jul 28, 2022
  2. imzhuhl
    added a commit that references this issue on Jul 28, 2022

    pythongh-95355: Check tokens[0] after allocating memory

    1f6dc6b

  3. arhadthedev commented on Jul 28, 2022

    @arhadthedev
    arhadthedev
    on Jul 28, 2022
    Member

    @AlexWaygood It seems to be a type-crash since PyMem_Calloc() failure is ignored leading to a C null pointer access somewhere below.

  4. AlexWaygood commented on Jul 28, 2022

    @AlexWaygood
    AlexWaygood
    on Jul 28, 2022
    Member

    @AlexWaygood It seems to be a type-crash since PyMem_Calloc() failure is ignored leading to a C null pointer access somewhere below.

    Sounds plausible, but I'm not much of a C programmer, so I'll let somebody else do the relabelling :)

  5. miss-islington
    added 4 commits that reference this issue on Jul 28, 2022

    pythongh-95355: Check tokens[0] after allocating memory (pythonGH-95356)

    c2fb6ca

    gh-95355: Check tokens[0] after allocating memory (GH-95356)

    b946f52

    pythongh-95355: Check tokens[0] after allocating memory (pythonGH-95356)

    8cb867d

    gh-95355: Check tokens[0] after allocating memory (GH-95356)

    d3cc99b
  6. kumaraditya303
    added
    3.11only security fixes
    3.10 (EOL)end of life
    3.12only security fixes
    type-crashA hard crash of the interpreter, possibly with a core dump
    on Jul 28, 2022
  7. miss-islington
    added a commit that references this issue on Jul 28, 2022

    gh-95355: Check tokens[0] after allocating memory (GH-95356)

    4513e4a

  8. kumaraditya303 commented on Jul 28, 2022

    @kumaraditya303
    kumaraditya303
    on Jul 28, 2022
    Contributor

    Sounds plausible, but I'm not much of a C programmer, so I'll let somebody else do the relabelling :)

    Ok done, it can indeed segfault if allocation fails, classic null dereference :)

  9. kumaraditya303 commented on Jul 28, 2022

    @kumaraditya303
    kumaraditya303
    on Jul 28, 2022
    Contributor

    Fixed by #95356, thanks for the report!

  10. kumaraditya303
    closed this as completedon Jul 28, 2022
  11. AlexWaygood
    removed
    type-bugAn unexpected behavior, bug, or error
    on Jul 28, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.10 (EOL)end of life3.11only security fixes3.12only security fixestype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions