René's URL Explorer Experiment

Title: gh-144475: Fix use-after-free in functools.partial.__repr__() by Nicolas0315 · Pull Request #145395 · python/cpython · GitHub

Open Graph Title: gh-144475: Fix use-after-free in functools.partial.__repr__() by Nicolas0315 · Pull Request #145395 · python/cpython

X Title: gh-144475: Fix use-after-free in functools.partial.__repr__() by Nicolas0315 · Pull Request #145395 · python/cpython

Description: Summary Fix a heap-buffer-overflow (use-after-free) in functools.partial.__repr__() where a user-defined __repr__() on an argument could mutate the partial object via __setstate__(), freeing the args tuple while partial_repr() was still iterating over it. Root Cause partial_repr() captured the size of pto->args before the loop and accessed tuple items via borrowed references (PyTuple_GET_ITEM). If a __repr__() called during %R formatting invoked pto.__setstate__() with a new (smaller) args tuple, the original tuple was freed while iteration continued, causing an out-of-bounds read. Fix Hold strong references (Py_NewRef) to pto->args, pto->kw, and pto->fn before iterating/using them. This ensures the underlying objects remain alive even if user code mutates the partial via __setstate__() during formatting. The same pattern is applied to: pto->args: The positional arguments tuple iterated in the loop pto->kw: The keyword arguments dict iterated via PyDict_Next pto->fn: The callable whose __repr__ is invoked via %R Reproducer (from the issue) import gc from functools import partial g_partial = None class EvilObject: def __init__(self, name, is_trigger=False): self.name = name self.is_trigger = is_trigger self.triggered = False def __repr__(self): global g_partial if self.is_trigger and not self.triggered and g_partial is not None: self.triggered = True new_state = (lambda x: x, ("replaced",), {}, None) g_partial.__setstate__(new_state) gc.collect() return f"EvilObject({self.name})" evil1 = EvilObject("trigger", is_trigger=True) evil2 = EvilObject("victim1") evil3 = EvilObject("victim2") p = partial(lambda: None, evil1, evil2, evil3) g_partial = p del evil1, evil2, evil3 repr(p) # heap-buffer-overflow without fix Fixes #144475. Issue: gh-144475

Open Graph Description: Summary Fix a heap-buffer-overflow (use-after-free) in functools.partial.__repr__() where a user-defined __repr__() on an argument could mutate the partial object via __setstate__(), freeing the ar...

X Description: Summary Fix a heap-buffer-overflow (use-after-free) in functools.partial.__repr__() where a user-defined __repr__() on an argument could mutate the partial object via __setstate__(), freeing the ar...

Opengraph URL: https://github.com/python/cpython/pull/145395

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width