[New-bugs-announce] [issue8352] imp.find_module of a .py ending dir causes glibc double free crash

[Matthias Klose]

New submission from Matthias Klose <doko at debian.org>:

[forwarded from http://bugs.debian.org/577005]

seen with 2.5.5, 2.6.5 and 2.7alpha4:

The imp.find_module function causes a glibc double free or corruption if
it would be invoked with a directory with a ".py" ending. It can be
reproduced with:

mkdir bla.py; python -c 'import imp; imp.find_module("bla", ["."])'

This causes bpython to crash after the first input char if such a
directory exist.


stacktrace with 2.6.5:
(gdb) bt
#0  0x00355906 in *__GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00358e05 in *__GI_abort () at abort.c:88
#2  0x0038c78d in __libc_message (do_abort=2, fmt=0x453088 "*** glibc detected *** %s: %s: 0x%s ***\n")
    at ../sysdeps/unix/sysv/linux/libc_fatal.c:173
#3  0x00396905 in malloc_printerr (action=2, str=0x453230 "double free or corruption (!prev)", ptr=
    0x83004e0) at malloc.c:6239
#4  0x003981a3 in _int_free (av=0x46f3c0, p=0x83004d8) at malloc.c:4772
#5  0x0039b22d in *__GI___libc_free (mem=0x83004e0) at malloc.c:3738
#6  0x00386b55 in _IO_new_fclose (fp=0x83004e0) at iofclose.c:88
#7  0x08116efc in call_find_module (name=0xb7f52a54 "bla", path=['.']) at ../Python/import.c:2844
#8  0x08117011 in imp_find_module (self=<unknown at remote 0x0>, args=('bla', ['.']))
    at ../Python/import.c:2865
#9  0x081b1755 in PyCFunction_Call (func=<builtin_function_or_method at remote 0xb7f3cc3c>, arg=
    ('bla', ['.']), kw=<unknown at remote 0x0>) at ../Objects/methodobject.c:81
#10 0x080fbf03 in call_function (pp_stack=0xbffff3cc, oparg=2) at ../Python/ceval.c:3750
#11 0x080f75ac in PyEval_EvalFrameEx (f=File <string>, line 1, in <module> (), throwflag=0)
    at ../Python/ceval.c:2412
#12 0x080f9c48 in PyEval_EvalCodeEx (co=0xb7fe6da8, globals=
    {'__builtins__': <module at remote 0xb7fb50c4>, '__name__': '__main__', '__package__': None, '__doc__': None, 'imp': <module at remote 0xb7fb5964>}, locals=
    {'__builtins__': <module at remote 0xb7fb50c4>, '__name__': '__main__', '__package__': None, '__doc__': None, 'imp': <module at remote 0xb7fb5964>}, args=0x0, argcount=0, kws=0x0, kwcount=0, defs=0x0, 
    defcount=0, closure=<unknown at remote 0x0>) at ../Python/ceval.c:3000
#13 0x080efd6b in PyEval_EvalCode (co=0xb7fe6da8, globals=
    {'__builtins__': <module at remote 0xb7fb50c4>, '__name__': '__main__', '__package__': None, '__doc__': None, 'imp': <module at remote 0xb7fb5964>}, locals=
    {'__builtins__': <module at remote 0xb7fb50c4>, '__name__': '__main__', '__package__': None, '__doc__': None, 'imp': <module at remote 0xb7fb5964>}) at ../Python/ceval.c:541
#14 0x0812376c in run_mod (mod=0x83565c0, filename=0x81ef6b1 "<string>", globals=
    {'__builtins__': <module at remote 0xb7fb50c4>, '__name__': '__main__', '__package__': None, '__doc__': None, 'imp': <module at remote 0xb7fb5964>}, locals=
    {'__builtins__': <module at remote 0xb7fb50c4>, '__name__': '__main__', '__package__': None, '__doc__': None, 'imp': <module at remote 0xb7fb5964>}, flags=0xbffff6c0, arena=0x82f5700)
    at ../Python/pythonrun.c:1339
#15 0x08123640 in PyRun_StringFlags (str=0x82e5008 "import imp; imp.find_module(\"bla\", [\".\"])\n", 
    start=257, globals=
    {'__builtins__': <module at remote 0xb7fb50c4>, '__name__': '__main__', '__package__': None, '__doc__': None, 'imp': <module at remote 0xb7fb5964>}, locals=
    {'__builtins__': <module at remote 0xb7fb50c4>, '__name__': '__main__', '__package__': None, '__doc__': None, 'imp': <module at remote 0xb7fb5964>}, flags=0xbffff6c0) at ../Python/pythonrun.c:1302
#16 0x081223e9 in PyRun_SimpleStringFlags (command=
    0x82e5008 "import imp; imp.find_module(\"bla\", [\".\"])\n", flags=0xbffff6c0)
    at ../Python/pythonrun.c:961
#17 0x0805e3f6 in Py_Main (argc=3, argv=0xbffff7b4) at ../Modules/main.c:521
#18 0x0805d51f in main (argc=3, argv=0xbffff7b4) at ../Modules/python.c:23

----------
components: Interpreter Core
messages: 102662
nosy: doko
severity: normal
status: open
title: imp.find_module of a .py ending dir causes glibc double free crash
versions: Python 2.5, Python 2.6, Python 2.7

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue8352>
_______________________________________