Bad free in assemble function #87524

Activity

1. alexhenrie commented on Mar 2, 2021

   

   alexhenriemannequin

   on Mar 2, 2021

   MannequinAuthor

   More actions

   The assemble function in compile.c currently looks like this:

       static PyCodeObject *
       assemble(struct compiler *c, int addNone)
       {
           basicblock *b, *entryblock;
           struct assembler a;
           int j, nblocks;
           PyCodeObject *co = NULL;
           PyObject *consts = NULL;

       ...
   

           for (basicblock *b = c->u->u_blocks; b != NULL; b = b->b_list) {
               if (normalize_basic_block(b)) {
                   goto error;
               }
           }
   
           if (ensure_exits_have_lineno(c)) {
               goto error;
           }

       ...
   

        error:
           Py_XDECREF(consts);
           assemble_free(&a);
           return co;
       }

   If normalize_basic_block or ensure_exits_have_lineno fails, the function will attempt to free a.a_bytecode, which has not yet been initialized, possibly leading to a program crash.

   The problematic code was added by commit 5977a79 to fix bpo-42246.

   Defect identified by scan-build <https://clang-analyzer.llvm.org/scan-build.html\>
2. alexhenrie

   added

   3.10 (EOL)end of lifeend of life

   interpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)

   type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

   on Mar 2, 2021
3. markshannon commented on Mar 2, 2021

   

   markshannon

   on Mar 2, 2021

   Member

   More actions

   New changeset 503627f by Alex Henrie in branch 'master':
   bpo-43358: Fix bad free in assemble function (GH-24697)
   503627f
4. ezio-melotti

   transferred this issue fromon Apr 10, 2022
5. kumaraditya303

   closed this as completedon Apr 18, 2022