Skip to content

gh-156939: Fix memory corruption check in fcntl - #157103

Draft
vstinner wants to merge 4 commits into
python:mainfrom
vstinner:fcntl_canary
Draft

gh-156939: Fix memory corruption check in fcntl#157103
vstinner wants to merge 4 commits into
python:mainfrom
vstinner:fcntl_canary

Conversation

@vstinner

@vstinner vstinner commented Sep 7, 2026

Copy link
Copy Markdown
Member

For "large" buffer using PyBytesWriter, copy guard bytes rather than just checking the last trailing byte.

Allocate one extra "canary byte" to detect buffer overflow.

Previously, the canary byte (NUL byte) was written after the
allocated byte which would lead to buffer overflow if the bytes
writer uses the small buffer.
@vstinner

This comment was marked as outdated.

@vstinner

vstinner commented Sep 7, 2026

Copy link
Copy Markdown
Member Author

Python 3.13 and 3.14 are not affected. They fail with an error if the buffer size is larger than 1024 bytes.

@vstinner vstinner changed the title gh-156939: Fix buffer overflow in fcntl gh-156939: Fix memory corruption check in fcntl Sep 7, 2026
@vstinner vstinner added skip news needs backport to 3.15 pre-release feature fixes, bugs and security fixes labels Sep 7, 2026

@vstinner vstinner left a comment

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

With this change, I'm not sure that it's still needed to have a "fast path" (is it really faster?) for buffer smaller than or equal to 1024 bytes (the code path which doesn't use PyBytesWriter).

            // Truncate the trailing guard bytes
            return PyBytesWriter_FinishWithSize(writer, len);

The updated code now allocates extra 8 bytes and then resize the bytes object to truncate the last 8 bytes. It's less efficient than the previous code which relies on the fact that bytes objects always end with a trailing NUL byte. IMO it's better to have better check for memory overflow, than paying attention of the performance of such short operation.

@vstinner

vstinner commented Sep 7, 2026

Copy link
Copy Markdown
Member Author

Ubuntu (installed) / build, install and test

On a CI building Python in release mode, test_ioctl does crash :-(

0:04:01 load avg: 4.14 mem: 49.8 MiB [1/2/1] test_ioctl worker non-zero exit code (Exit code -6 (SIGABRT))
Re-running test_ioctl in verbose mode
test_bad_fd (test.test_ioctl.IoctlTestsPty.test_bad_fd) ... *** buffer overflow detected ***: terminated
Fatal Python error: Aborted

@vstinner

vstinner commented Sep 7, 2026

Copy link
Copy Markdown
Member Author

On a CI building Python in release mode, test_ioctl does crash :-(

Ah, I just found and fixed a typo.

@vstinner

vstinner commented Sep 7, 2026

Copy link
Copy Markdown
Member Author

Currently, the code is correct. It relies on the fact that bytes objects always end with a NUL byte.

This change is mostly needed if we decide to implement the check to detect buffer overflow in PyBytesWriter: PR gh-156943.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs backport to 3.15 pre-release feature fixes, bugs and security fixes skip news

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant