René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"socket.sendmsg() and socket.recvmsg_into() crash via __buffer__ re-entrancy (related to gh-143637)","articleBody":"# Crash report\n\n### What happened?\n\n\n## Bug description\n\nSimilar to gh-143637, `socket.sendmsg()` and `socket.recvmsg_into()` can crash due to re-entrant mutation during argument parsing, but via the `__buffer__` protocol instead of `__index__`.\n\n## Affected functions\n\n| Function | Argument | Trigger |\n|----------|----------|---------|\n| `sendmsg()` | arg 1 (data buffers) | `__buffer__` |\n| `recvmsg_into()` | arg 1 (buffers) | `__buffer__` |\n\n## Root cause\n\nSame as gh-143637: `PySequence_Fast()` returns the original list when input is already a list. During iteration, `PyObject_GetBuffer()` triggers `__buffer__` callbacks which can clear the list, causing subsequent accesses to read invalid memory.\n\n## PoC - sendmsg() crash\n\n```python\nimport socket\n\nseq = []\n\nclass MutBuffer:\n    def __init__(self, data):\n        self._data = bytes(data)\n        self.tripped = False\n    \n    def __buffer__(self, flags):\n        if not self.tripped:\n            self.tripped = True\n            seq.clear()\n        return memoryview(self._data)\n\nseq[:] = [MutBuffer(b'Hello'), b'World', b'Test']\nleft, right = socket.socketpair()\nleft.sendmsg(seq)  # CRASH: Exit code 139 (SIGSEGV)\n```\n\n## PoC - recvmsg_into() crash\n\n```python\nimport socket\n\nseq = []\n\nclass MutBuffer:\n    def __init__(self, data):\n        self._data = bytearray(data)\n        self.tripped = False\n    \n    def __buffer__(self, flags):\n        if not self.tripped:\n            self.tripped = True\n            seq.clear()\n        return memoryview(self._data)\n\nseq[:] = [MutBuffer(b'x' * 100), bytearray(100), bytearray(100)]\nleft, right = socket.socketpair()\nleft.send(b'Hello World!')\nright.recvmsg_into(seq)  # CRASH: Exit code 139 (SIGSEGV)\n```\n\n## Fix\n\nReplace `PySequence_Fast()` with `PySequence_Tuple()` in `sock_sendmsg_iovec()` and `sock_recvmsg_into()`.\n\nI have a PR ready.\n\n## CPython versions tested on:\n\nmain branch (3.15.0a5+)\n\n## Operating system and architecture:\n\nmacOS 15.0 arm64\n\n\n### CPython versions tested on:\n\nCPython main branch\n\n### Operating systems tested on:\n\nmacOS\n\n### Output from running 'python -VV' on the command line:\n\n_No response_\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-143987\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/tonghuaroot","@type":"Person","name":"tonghuaroot"},"datePublished":"2026-01-18T06:56:04.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/143988/cpython/issues/143988"}