Skip to content

Conversation

gaogaotiantian
Copy link
Member

@gaogaotiantian gaogaotiantian commented Mar 26, 2023

In ./Modules/_xxsubinterpretersmodule.c a variable _sharedexception exc on stack is declared introduced in #102659. The variable is not initialized.

In _run_script, it's possible that the function hits an error and goes to error label without properly initializing the variable. Then _sharedexception_bind can also potentially error out to trigger _sharedexception_clear(sharedexc), which may free the uninitialized pointer. I have not found an exploit on this, but there's a potential path. Also the fix is so easy and cheap so I think we can just initialize the variable with no_exception (basically {0}).

Oh BTW, gcc complains with the possible unitialized variable.

I would guess @ericsnowcurrently is the right person to review this? Thanks!

@iritkatriel
Copy link
Member

CC @ericsnowcurrently

@arhadthedev arhadthedev added type-bug An unexpected behavior, bug, or error extension-modules C modules in the Modules dir topic-subinterpreters labels Mar 30, 2023
@gaogaotiantian
Copy link
Member Author

Fixed in #103245

@gaogaotiantian gaogaotiantian deleted the uninitialized-sharedexception branch April 9, 2023 03:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
awaiting review extension-modules C modules in the Modules dir topic-subinterpreters type-bug An unexpected behavior, bug, or error
Projects
Status: Done
Development

Successfully merging this pull request may close these issues.

4 participants