Repository navigation
UAF in Element.findtext() when tag __eq__ mutates parent #148735
Description
Crash report
What happened?
Similar to #126037.
from xml.etree.ElementTree import Element, SubElement
class T(str):
def __eq__(self, other):
root.clear()
return True
root = Element('a')
SubElement(root, T('a')).text = str(object())
repr(root.findtext('a'))Under UBSan results in:
Objects/object.c:766:19: runtime error: member access within misaligned address 0xdddddddddddddddd for type 'struct PyTypeObject', which requires 8 byte alignment
0xdddddddddddddddd: note: pointer points here
<memory cannot be printed>
Segmentation fault (core dumped)
CPython versions tested on:
CPython main branch
Operating systems tested on:
No response
Output from running 'python -VV' on the command line:
No response
Activity
gh-148735: Fix a UAF in `Element.findtext()` (#148738)
[3.14] gh-148735: Fix a UAF in `Element.findtext()` (GH-148738) (#148916
[3.13] gh-148735: Fix a UAF in `Element.findtext()` (GH-148738) (#148923
pythongh-148735: Fix a UAF in `Element.findtext()` (python#148738)