Repository navigation
socket.sendmsg() and socket.recvmsg_into() crash via __buffer__ re-entrancy (related to gh-143637) #143988
Description
Crash report
What happened?
Bug description
Similar to gh-143637, socket.sendmsg() and socket.recvmsg_into() can crash due to re-entrant mutation during argument parsing, but via the __buffer__ protocol instead of __index__.
Affected functions
| Function | Argument | Trigger |
|---|---|---|
sendmsg() |
arg 1 (data buffers) | __buffer__ |
recvmsg_into() |
arg 1 (buffers) | __buffer__ |
Root cause
Same as gh-143637: PySequence_Fast() returns the original list when input is already a list. During iteration, PyObject_GetBuffer() triggers __buffer__ callbacks which can clear the list, causing subsequent accesses to read invalid memory.
PoC - sendmsg() crash
import socket
seq = []
class MutBuffer:
def __init__(self, data):
self._data = bytes(data)
self.tripped = False
def __buffer__(self, flags):
if not self.tripped:
self.tripped = True
seq.clear()
return memoryview(self._data)
seq[:] = [MutBuffer(b'Hello'), b'World', b'Test']
left, right = socket.socketpair()
left.sendmsg(seq) # CRASH: Exit code 139 (SIGSEGV)PoC - recvmsg_into() crash
import socket
seq = []
class MutBuffer:
def __init__(self, data):
self._data = bytearray(data)
self.tripped = False
def __buffer__(self, flags):
if not self.tripped:
self.tripped = True
seq.clear()
return memoryview(self._data)
seq[:] = [MutBuffer(b'x' * 100), bytearray(100), bytearray(100)]
left, right = socket.socketpair()
left.send(b'Hello World!')
right.recvmsg_into(seq) # CRASH: Exit code 139 (SIGSEGV)Fix
Replace PySequence_Fast() with PySequence_Tuple() in sock_sendmsg_iovec() and sock_recvmsg_into().
I have a PR ready.
CPython versions tested on:
main branch (3.15.0a5+)
Operating system and architecture:
macOS 15.0 arm64
CPython versions tested on:
CPython main branch
Operating systems tested on:
macOS
Output from running 'python -VV' on the command line:
No response
Linked PRs
- gh-143988: Fix re-entrant mutation crashes in socket sendmsg/recvmsg_into via
__buffer__#143987 - [3.15] gh-143988: Fix re-entrant mutation crashes in socket sendmsg/recvmsg_into (GH-143987) #151246
- [3.14] gh-143988: Fix re-entrant mutation crashes in socket sendmsg/recvmsg_into (#143987) #151251
- [3.13] gh-143988: Fix re-entrant mutation crashes in socket sendmsg/recvmsg_into (#143987) (#151251) #151256
Activity
pythongh-143988: Fix re-entrant mutation crashes in socket sendmsg/re…
pythongh-143988: Fix re-entrant mutation crashes in socket sendmsg/re…
pythongh-143988: Fix re-entrant mutation crashes in socket sendmsg/re…
pythongh-143988: Fix re-entrant mutation crashes in socket sendmsg/re…
pythongh-143988: Fix re-entrant mutation crashes in socket sendmsg/re…
gh-143988: Fix re-entrant mutation crashes in socket sendmsg/recvmsg_…
pythongh-143988: Fix re-entrant mutation crashes in socket sendmsg/re…
[3.14] gh-143988: Fix re-entrant mutation crashes in socket sendmsg/r…
[3.15] gh-143988: Fix re-entrant mutation crashes in socket sendmsg/r…
[3.13][3.14] gh-143988: Fix re-entrant mutation crashes in socket sen…
pythongh-143988: Fix re-entrant mutation crashes in socket sendmsg/re…