[New-bugs-announce] [issue38395] proxy_contains (weakref.proxy) can access an object with 0 refcount

[Sam Gross]

New submission from Sam Gross <colesbury at gmail.com>:

The implementation of weakref.proxy's methods call back into the Python API using a "borrowed reference" of the weakly referenced object (acquired via PyWeakref_GET_OBJECT). This API call may delete the last reference to the object (either directly or via GC), leaving a dangling pointer, which can be subsequently dereferenced.

Tested with Python 3.8.0b4 (debug build)

The following code crashes with a debug build of Python 3.8.0b4 on Linux.

import weakref

obj = None

class MyObj:
    def __iter__(self):
        global obj
        del obj
        return NotImplemented

obj = MyObj()
p = weakref.proxy(obj)
print(5 in p)


This particular test case does not crash with a release build (on Linux).

The implementation of `in` on a proxy object calls proxy_contains:

   return PySequence_Contains(PyWeakref_GET_OBJECT(proxy), value);

https://github.com/python/cpython/blob/v3.8.0b4/Objects/weakrefobject.c#L556


This eventually calls _PySequence_IterSearch. The call to PyObject_GetIter can call arbitrary code, which can lead to seq (the proxy's referent) being deleted. The subsequent call to type_error dereferences a dead object. 

    it = PyObject_GetIter(seq);
    if (it == NULL) {
        type_error("argument of type '%.200s' is not iterable", seq);
        return -1;
    }

https://github.com/python/cpython/blob/v3.8.0b4/Objects/abstract.c#L2003-L2007

I believe some functions, like proxy_length, may be immune to this problem because they do not access the borrowed referent after calling into user code. However, this is hard to verify from reading the code and may be fragile -- small changes to PyObject_Length/Size, for example, might .

See also https://bugs.python.org/issue16602

----------
components: Interpreter Core
messages: 354102
nosy: colesbury
priority: normal
severity: normal
status: open
title: proxy_contains (weakref.proxy) can access an object with 0 refcount
type: crash
versions: Python 3.8

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue38395>
_______________________________________