Repository navigation
heap uaf in _lsprof via enable() #157639
Description
Bug report
Bug description:
import _lsprof
prof = _lsprof.Profiler()
def _timer():
try:
prof.enable()
except Exception:
pass
return 0
prof.__init__(timer=_timer)
prof.enable()
def foo():
return 1
foo()
prof.disable() ASAN output (truncated:
==ERROR: AddressSanitizer: heap-use-after-free ... READ of size 8
#0 ptrace_enter_call Modules/_lsprof.c:383
#1 _lsprof_Profiler__ccall_callback_impl Modules/_lsprof.c:733
freed by thread T0 here:
#1 flush_unmatched Modules/_lsprof.c:873
#2 _lsprof_Profiler_disable_impl Modules/_lsprof.c:930
previously allocated by thread T0 here:
#1 ptrace_enter_call Modules/_lsprof.c:388
SUMMARY: AddressSanitizer: heap-use-after-free Modules/_lsprof.c:383 in ptrace_enter_call
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Linked PRs
- gh-157639: Fix use-after-free when an external timer re-enters the profiler #157648
- [3.15] gh-157639: Fix use-after-free when an external timer re-enters the profiler (GH-157648) #158113
- [3.14] gh-157639: Fix use-after-free when an external timer re-enters the profiler (GH-157648) #158115
- [3.13] gh-157639: Fix use-after-free when an external timer re-enters the profiler (GH-157648) #158118
Activity
gh-157639: Fix use-after-free when an external timer re-enters the pr…
[3.13] gh-157639: Fix use-after-free when an external timer re-enters…
[3.15] gh-157639: Fix use-after-free when an external timer re-enters…
[3.14] gh-157639: Fix use-after-free when an external timer re-enters…