Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gh-101659: initialize stack variable _sharedexception #103048

Conversation

gaogaotiantian
Copy link
Member

@gaogaotiantian gaogaotiantian commented Mar 26, 2023

In ./Modules/_xxsubinterpretersmodule.c a variable _sharedexception exc on stack is declared introduced in #102659. The variable is not initialized.

In _run_script, it's possible that the function hits an error and goes to error label without properly initializing the variable. Then _sharedexception_bind can also potentially error out to trigger _sharedexception_clear(sharedexc), which may free the uninitialized pointer. I have not found an exploit on this, but there's a potential path. Also the fix is so easy and cheap so I think we can just initialize the variable with no_exception (basically {0}).

Oh BTW, gcc complains with the possible unitialized variable.

I would guess @ericsnowcurrently is the right person to review this? Thanks!

@iritkatriel
Copy link
Member

CC @ericsnowcurrently

@arhadthedev arhadthedev added type-bug An unexpected behavior, bug, or error extension-modules C modules in the Modules dir topic-subinterpreters labels Mar 30, 2023
@gaogaotiantian
Copy link
Member Author

Fixed in #103245

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
awaiting review extension-modules C modules in the Modules dir topic-subinterpreters type-bug An unexpected behavior, bug, or error
Projects
Status: Done
Development

Successfully merging this pull request may close these issues.

4 participants