Skip to content

gh-142560: bytearray: prevent UAF in search-like methods by exporting self buffer #142564

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fatelei wants to merge 21 commits into
base: main
Choose a base branch
from
+87 −36
Open

gh-142560: bytearray: prevent UAF in search-like methods by exporting self buffer #142564

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
887afac
fix: bytearray: prevent UAF in search-like methods by exporting self …
fatelei Dec 11, 2025
2dd958b
chore: add blurb
fatelei Dec 11, 2025
2cb388b
fix: fix new format
fatelei Dec 11, 2025
b954fc7
fix: fix python lint error and make code more simple
fatelei Dec 12, 2025
87b5cce
fix: fix code not regenerate
fatelei Dec 12, 2025
f1b7596
fix: fix ubuntu test failed for ass_subscript2
fatelei Dec 12, 2025
13a6469
chore: add comment for method test_search_methods_reentrancy_raises_b…
fatelei Dec 12, 2025
b5efa3f
refactor: refactor test_search_methods_reentrancy_raises_buffererror …
fatelei Dec 12, 2025
62b2801
fix: fix pre commit failed
fatelei Dec 12, 2025
8419650
chore: using subTest to distinguish which method failed
fatelei Dec 12, 2025
2df5acb
chore: using more light operation instead of heavy operation
fatelei Dec 12, 2025
e6c622e
fix: fix pre-commit error
fatelei Dec 12, 2025
7964033
chore: resolve comment
fatelei Dec 15, 2025
8b1cea2
chore: resolve comment
fatelei Dec 15, 2025
782cab1
chore: update the news
fatelei Dec 15, 2025
14963ea
chore: bytearray_contains add Py_BEGIN_CRITICAL_SECTION back
fatelei Dec 15, 2025
87225ad
fix: fix build failed
fatelei Dec 15, 2025
4214d56
chore: resolve comment
fatelei Dec 15, 2025
01fcc68
fix: fix pre commit error
fatelei Dec 15, 2025
6a58ffe
fix: fix news format
fatelei Dec 15, 2025
abb9fb7
fix: fix news format
fatelei Dec 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
fix: fix python lint error and make code more simple
  • Loading branch information
@fatelei
fatelei committed Dec 12, 2025
commit b954fc74ecf93d71e70d9515f25324f80435e18a
1 change: 0 additions & 1 deletion Lib/test/test_bytes.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2078,7 +2078,6 @@ def __index__(self):
ba.rfind(Evil())



class AssortedBytesTest(unittest.TestCase):
#
# Test various combinations of bytes and bytearray
Expand Down
81 changes: 24 additions & 57 deletions Objects/bytearrayobject.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1228,21 +1228,32 @@ Return the lowest index in B where subsection 'sub' is found, such that 'sub' is
Return -1 on failure.
[clinic start generated code]*/

typedef PyObject* (*_ba_bytes_op)(const char *buf, Py_ssize_t len,
PyObject *sub, Py_ssize_t start,
Py_ssize_t end);

static PyObject *
bytearray_find_impl(PyByteArrayObject *self, PyObject *sub, Py_ssize_t start,
Py_ssize_t end)
/*[clinic end generated code: output=413e1cab2ae87da0 input=df3aa94840d893a7]*/
_bytearray_with_buffer(PyByteArrayObject *self, PyObject *sub,
Py_ssize_t start, Py_ssize_t end, _ba_bytes_op op)
{
Py_buffer selfbuf;
Py_buffer view;
PyObject *res;
if (PyObject_GetBuffer((PyObject *)self, &selfbuf, PyBUF_SIMPLE) != 0) {
if (PyObject_GetBuffer((PyObject *)self, &view, PyBUF_SIMPLE) != 0) {
return NULL;
}
res = _Py_bytes_find((const char *)selfbuf.buf, selfbuf.len, sub, start, end);
PyBuffer_Release(&selfbuf);
res = op((const char *)view.buf, view.len, sub, start, end);
PyBuffer_Release(&view);
return res;
}

static PyObject *
bytearray_find_impl(PyByteArrayObject *self, PyObject *sub, Py_ssize_t start,
Py_ssize_t end)
/*[clinic end generated code: output=413e1cab2ae87da0 input=df3aa94840d893a7]*/
{
return _bytearray_with_buffer(self, sub, start, end, _Py_bytes_find);
}

/*[clinic input]
@permit_long_summary
@critical_section
Expand All @@ -1256,14 +1267,7 @@ bytearray_count_impl(PyByteArrayObject *self, PyObject *sub,
Py_ssize_t start, Py_ssize_t end)
/*[clinic end generated code: output=a21ee2692e4f1233 input=e8fcdca8272857e0]*/
{
Py_buffer selfbuf;
PyObject *res;
if (PyObject_GetBuffer((PyObject *)self, &selfbuf, PyBUF_SIMPLE) != 0) {
return NULL;
}
res = _Py_bytes_count((const char *)selfbuf.buf, selfbuf.len, sub, start, end);
PyBuffer_Release(&selfbuf);
return res;
return _bytearray_with_buffer(self, sub, start, end, _Py_bytes_count);
}

/*[clinic input]
Expand Down Expand Up @@ -1311,14 +1315,7 @@ bytearray_index_impl(PyByteArrayObject *self, PyObject *sub,
Py_ssize_t start, Py_ssize_t end)
/*[clinic end generated code: output=067a1e78efc672a7 input=c37f177cfee19fe4]*/
{
Py_buffer selfbuf;
PyObject *res;
if (PyObject_GetBuffer((PyObject *)self, &selfbuf, PyBUF_SIMPLE) != 0) {
return NULL;
}
res = _Py_bytes_index((const char *)selfbuf.buf, selfbuf.len, sub, start, end);
PyBuffer_Release(&selfbuf);
return res;
return _bytearray_with_buffer(self, sub, start, end, _Py_bytes_index);
}

/*[clinic input]
Expand All @@ -1336,14 +1333,7 @@ bytearray_rfind_impl(PyByteArrayObject *self, PyObject *sub,
Py_ssize_t start, Py_ssize_t end)
/*[clinic end generated code: output=51bf886f932b283c input=1265b11c437d2750]*/
{
Py_buffer selfbuf;
PyObject *res;
if (PyObject_GetBuffer((PyObject *)self, &selfbuf, PyBUF_SIMPLE) != 0) {
return NULL;
}
res = _Py_bytes_rfind((const char *)selfbuf.buf, selfbuf.len, sub, start, end);
PyBuffer_Release(&selfbuf);
return res;
return _bytearray_with_buffer(self, sub, start, end, _Py_bytes_rfind);
}

/*[clinic input]
Expand All @@ -1361,14 +1351,7 @@ bytearray_rindex_impl(PyByteArrayObject *self, PyObject *sub,
Py_ssize_t start, Py_ssize_t end)
/*[clinic end generated code: output=38e1cf66bafb08b9 input=7d198b3d6b0a62ce]*/
{
Py_buffer selfbuf;
PyObject *res;
if (PyObject_GetBuffer((PyObject *)self, &selfbuf, PyBUF_SIMPLE) != 0) {
return NULL;
}
res = _Py_bytes_rindex((const char *)selfbuf.buf, selfbuf.len, sub, start, end);
PyBuffer_Release(&selfbuf);
return res;
return _bytearray_with_buffer(self, sub, start, end, _Py_bytes_rindex);
}

static int
Expand Down Expand Up @@ -1406,15 +1389,7 @@ bytearray_startswith_impl(PyByteArrayObject *self, PyObject *subobj,
Py_ssize_t start, Py_ssize_t end)
/*[clinic end generated code: output=a3d9b6d44d3662a6 input=93f9ffee684f109a]*/
{
Py_buffer selfbuf;
PyObject *res;
if (PyObject_GetBuffer((PyObject *)self, &selfbuf, PyBUF_SIMPLE) != 0) {
return NULL;
}
res = _Py_bytes_startswith((const char *)selfbuf.buf, selfbuf.len,
subobj, start, end);
PyBuffer_Release(&selfbuf);
return res;
return _bytearray_with_buffer(self, subobj, start, end, _Py_bytes_startswith);
}

/*[clinic input]
Expand All @@ -1439,15 +1414,7 @@ bytearray_endswith_impl(PyByteArrayObject *self, PyObject *subobj,
Py_ssize_t start, Py_ssize_t end)
/*[clinic end generated code: output=e75ea8c227954caa input=d158b030a11d0b06]*/
{
Py_buffer selfbuf;
PyObject *res;
if (PyObject_GetBuffer((PyObject *)self, &selfbuf, PyBUF_SIMPLE) != 0) {
return NULL;
}
res = _Py_bytes_endswith((const char *)selfbuf.buf, selfbuf.len,
subobj, start, end);
PyBuffer_Release(&selfbuf);
return res;
return _bytearray_with_buffer(self, subobj, start, end, _Py_bytes_endswith);
}

/*[clinic input]
Expand Down
Loading