io.TextIOWrapper UAF triggered by readline()

Bug report

Bug description:

import io
class R(io.RawIOBase):
    def readable(self): return True
    def readinto(self,b):
        tw.detach(); b[:3]=b"ab\n"; return 3
tw=io.TextIOWrapper(io.BufferedReader(R()),encoding="utf-8")
tw.readline();

Exception ignored while finalizing file <_io.BufferedReader>:
Traceback (most recent call last):
  File "/repro/audit4/repro/textio_detach_uaf_readline.py", line 5, in readinto
    tw.detach(); b[:3]=b"ab\n"; return 3
    ~~~~~~~~~^^
RuntimeError: reentrant call inside <_io.BufferedReader>
=================================================================
==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x50f000038a20 at pc 0xaaaacdacc864 bp 0xffffd28429c0 sp 0xffffd28429b0
READ of size 8 at 0x50f000038a20 thread T0
    #0 0xaaaacdacc860 in _bufferedreader_raw_read Modules/_io/bufferedio.c:1667
    #1 0xaaaacdad17c0 in _io__Buffered_read1_impl Modules/_io/bufferedio.c:1080
    #2 0xaaaacdad17c0 in _io__Buffered_read1 Modules/_io/clinic/bufferedio.c.h:721
    #3 0xaaaacd059b50 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #4 0xaaaacd059b50 in PyObject_VectorcallMethod Objects/call.c:921
    #5 0xaaaacdadbd48 in PyObject_CallMethodOneArg Include/cpython/abstract.h:74
    #6 0xaaaacdadbd48 in buffer_callmethod_onearg Modules/_io/textio.c:792
    #7 0xaaaacdaf42f8 in textiowrapper_read_chunk Modules/_io/textio.c:1996
    #8 0xaaaacdaf8508 in _textiowrapper_readline Modules/_io/textio.c:2307
    #9 0xaaaacd056320 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #10 0xaaaacd056320 in PyObject_Vectorcall Objects/call.c:327
    #11 0xaaaacd6a1bc8 in _Py_VectorCallInstrumentation_StackRefSteal Python/ceval.c:768
    #12 0xaaaaccdd1de8 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1906
    #13 0xaaaacd6c0b1c in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
    #14 0xaaaacd6c0b1c in _PyEval_Vector Python/ceval.c:2174
    #15 0xaaaacd6c0b1c in PyEval_EvalCode Python/ceval.c:679
    #16 0xaaaacd8bfeb4 in run_mod Python/pythonrun.c:1509
    #17 0xaaaacd8c0d38 in _PyRun_File Python/pythonrun.c:1332
    #18 0xaaaacd8c4ffc in _PyRun_SimpleFile Python/pythonrun.c:544
    #19 0xaaaacd8c8dd0 in _PyRun_AnyFile Python/pythonrun.c:92
    #20 0xaaaacd99390c in pymain_run_file_obj Modules/main.c:478
    #21 0xaaaacd99390c in pymain_run_file Modules/main.c:494
    #22 0xaaaacd99390c in pymain_run_python Modules/main.c:804
    #23 0xaaaacd99390c in Py_RunMain Modules/main.c:891
    #24 0xaaaacd995c38 in pymain_main Modules/main.c:921
    #25 0xaaaacd995c38 in Py_BytesMain Modules/main.c:945
    #26 0xffff8b8f84c0  (/lib/aarch64-linux-gnu/libc.so.6+0x284c0) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #27 0xffff8b8f8594 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28594) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #28 0xaaaacce3beec in _start (/src/cpython/python+0x183beec) (BuildId: eba909a3db0adabacf151d7dc3081dda7999191a)

0x50f000038a20 is located 64 bytes inside of 168-byte region [0x50f0000389e0,0x50f000038a88)
freed by thread T0 here:
    #0 0xffff8c2961b4 in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
    #1 0xaaaacdabd8dc in buffered_dealloc Modules/_io/bufferedio.c:444
    #2 0xaaaacd247ab0 in _Py_Dealloc Objects/object.c:3334
    #3 0xaaaaccdffea0 in Py_DECREF_MORTAL Include/internal/pycore_object.h:449
    #4 0xaaaaccdffea0 in PyStackRef_XCLOSE Include/internal/pycore_stackref.h:726
    #5 0xaaaaccdffea0 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:11163
    #6 0xaaaacd6c1a00 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
    #7 0xaaaacd6c1a00 in _PyEval_Vector Python/ceval.c:2174
    #8 0xaaaacd059b50 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #9 0xaaaacd059b50 in PyObject_VectorcallMethod Objects/call.c:921
    #10 0xaaaacdacc2d8 in PyObject_CallMethodOneArg Include/cpython/abstract.h:74
    #11 0xaaaacdacc2d8 in _bufferedreader_raw_read Modules/_io/bufferedio.c:1640
    #12 0xaaaacdad17c0 in _io__Buffered_read1_impl Modules/_io/bufferedio.c:1080
    #13 0xaaaacdad17c0 in _io__Buffered_read1 Modules/_io/clinic/bufferedio.c.h:721
    #14 0xaaaacd059b50 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #15 0xaaaacd059b50 in PyObject_VectorcallMethod Objects/call.c:921
    #16 0xaaaacdadbd48 in PyObject_CallMethodOneArg Include/cpython/abstract.h:74
    #17 0xaaaacdadbd48 in buffer_callmethod_onearg Modules/_io/textio.c:792
    #18 0xaaaacdaf42f8 in textiowrapper_read_chunk Modules/_io/textio.c:1996
    #19 0xaaaacdaf8508 in _textiowrapper_readline Modules/_io/textio.c:2307
    #20 0xaaaacd056320 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #21 0xaaaacd056320 in PyObject_Vectorcall Objects/call.c:327
    #22 0xaaaacd6a1bc8 in _Py_VectorCallInstrumentation_StackRefSteal Python/ceval.c:768
    #23 0xaaaaccdd1de8 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1906
    #24 0xaaaacd6c0b1c in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
    #25 0xaaaacd6c0b1c in _PyEval_Vector Python/ceval.c:2174
    #26 0xaaaacd6c0b1c in PyEval_EvalCode Python/ceval.c:679
    #27 0xaaaacd8bfeb4 in run_mod Python/pythonrun.c:1509
    #28 0xaaaacd8c0d38 in _PyRun_File Python/pythonrun.c:1332
    #29 0xaaaacd8c4ffc in _PyRun_SimpleFile Python/pythonrun.c:544
    #30 0xaaaacd8c8dd0 in _PyRun_AnyFile Python/pythonrun.c:92
    #31 0xaaaacd99390c in pymain_run_file_obj Modules/main.c:478
    #32 0xaaaacd99390c in pymain_run_file Modules/main.c:494
    #33 0xaaaacd99390c in pymain_run_python Modules/main.c:804
    #34 0xaaaacd99390c in Py_RunMain Modules/main.c:891
    #35 0xaaaacd995c38 in pymain_main Modules/main.c:921
    #36 0xaaaacd995c38 in Py_BytesMain Modules/main.c:945
    #37 0xffff8b8f84c0  (/lib/aarch64-linux-gnu/libc.so.6+0x284c0) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #38 0xffff8b8f8594 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28594) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #39 0xaaaacce3beec in _start (/src/cpython/python+0x183beec) (BuildId: eba909a3db0adabacf151d7dc3081dda7999191a)

previously allocated by thread T0 here:
    #0 0xffff8c2976d0 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0xaaaacd36077c in _PyObject_MallocWithType Include/internal/pycore_object_alloc.h:46
    #2 0xaaaacd36077c in _PyType_AllocNoTrack Objects/typeobject.c:2498
    #3 0xaaaacd360e00 in PyType_GenericAlloc Objects/typeobject.c:2529
    #4 0xaaaacd366808 in type_call Objects/typeobject.c:2442
    #5 0xaaaacd054250 in _PyObject_MakeTpCall Objects/call.c:242
    #6 0xaaaacd6a1bc8 in _Py_VectorCallInstrumentation_StackRefSteal Python/ceval.c:768
    #7 0xaaaaccdd1de8 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1906
    #8 0xaaaacd6c0b1c in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
    #9 0xaaaacd6c0b1c in _PyEval_Vector Python/ceval.c:2174
    #10 0xaaaacd6c0b1c in PyEval_EvalCode Python/ceval.c:679
    #11 0xaaaacd8bfeb4 in run_mod Python/pythonrun.c:1509
    #12 0xaaaacd8c0d38 in _PyRun_File Python/pythonrun.c:1332
    #13 0xaaaacd8c4ffc in _PyRun_SimpleFile Python/pythonrun.c:544
    #14 0xaaaacd8c8dd0 in _PyRun_AnyFile Python/pythonrun.c:92
    #15 0xaaaacd99390c in pymain_run_file_obj Modules/main.c:478
    #16 0xaaaacd99390c in pymain_run_file Modules/main.c:494
    #17 0xaaaacd99390c in pymain_run_python Modules/main.c:804
    #18 0xaaaacd99390c in Py_RunMain Modules/main.c:891
    #19 0xaaaacd995c38 in pymain_main Modules/main.c:921
    #20 0xaaaacd995c38 in Py_BytesMain Modules/main.c:945
    #21 0xffff8b8f84c0  (/lib/aarch64-linux-gnu/libc.so.6+0x284c0) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #22 0xffff8b8f8594 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28594) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #23 0xaaaacce3beec in _start (/src/cpython/python+0x183beec) (BuildId: eba909a3db0adabacf151d7dc3081dda7999191a)

SUMMARY: AddressSanitizer: heap-use-after-free Modules/_io/bufferedio.c:1667 in _bufferedreader_raw_read
Shadow bytes around the buggy address:
  0x50f000038780: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
  0x50f000038800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x50f000038880: 00 00 00 00 00 fa fa fa fa fa fa fa fa fa 00 00
  0x50f000038900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x50f000038980: 00 00 00 fa fa fa fa fa fa fa fa fa fd fd fd fd
=>0x50f000038a00: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
  0x50f000038a80: fd fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd
  0x50f000038b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x50f000038b80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x50f000038c00: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
  0x50f000038c80: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1==ABORTING

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

gh-157364: Fix use-after-free in TextIOWrapper during reentrant detach #157370

Related to #157363 but different error site

So there is a runtime error but we still have an UAF

In my repro under debug/ASan it goes even further: after _bufferedreader_raw_read returns, _io__Buffered_read1_impl crashes at LEAVE_BUFFERED(self) because self->lock is already dead (0xdd poisoned).

Just wrapping raw_read in Py_INCREF/Py_DECREF is a fragile band-aid that only masks the symptom.

This should be fixed at a higher level:

detach() must not release/clear the underlying buffer if it is actively locked in a reentrant call.
Or buffered_dealloc must not free the object/lock while it is currently acquired by the active thread.

@picnixz

@picnixz Also reproduced on default (GIL) build

CC=clang CXX=clang++ LDFLAGS='-fuse-ld=lld' ./configure --with-pydebug --with-address-sanitizer --with-undefined-behavior-sanitize

❯ ./python -X dev bug.py
Exception ignored while finalizing file <_io.BufferedReader>:
Traceback (most recent call last):
  File "/home/boss/projects/oss/cpython/main/bug.py", line 9, in readinto
    tw.detach()
    ~~~~~~~~~^^
RuntimeError: reentrant call inside <_io.BufferedReader>
=================================================================
==176750==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c9219425e90 at pc 0x55ceaec695c0 bp 0x7ffd8e863290 sp 0x7ffd8e863288
READ of size 8 at 0x7c9219425e90 thread T0
    #0 0x55ceaec695bf in _bufferedreader_raw_read /home/boss/projects/oss/cpython/main/./Modules/_io/bufferedio.c:1667:24
    #1 0x55ceaec70821 in _io__Buffered_read1_impl /home/boss/projects/oss/cpython/main/./Modules/_io/bufferedio.c:1080:20
    #2 0x55ceaec70821 in _io__Buffered_read1 /home/boss/projects/oss/cpython/main/./Modules/_io/clinic/bufferedio.c.h:721:20
    #3 0x55ceae2253bd in method_vectorcall_FASTCALL /home/boss/projects/oss/cpython/main/Objects/descrobject.c:402:24
    #4 0x55ceae1e0015 in _PyObject_VectorcallTstate /home/boss/projects/oss/cpython/main/./Include/internal/pycore_call.h:144:11
    #5 0x55ceae1e7119 in PyObject_VectorcallMethod /home/boss/projects/oss/cpython/main/Objects/call.c
    #6 0x55ceaec98362 in PyObject_CallMethodOneArg /home/boss/projects/oss/cpython/main/./Include/cpython/abstract.h:74:12
    #7 0x55ceaec98362 in buffer_callmethod_onearg /home/boss/projects/oss/cpython/main/./Modules/_io/textio.c:792:12
    #8 0x55ceaec98362 in textiowrapper_read_chunk /home/boss/projects/oss/cpython/main/./Modules/_io/textio.c:1996:19
    #9 0x55ceaec95a83 in _textiowrapper_readline /home/boss/projects/oss/cpython/main/./Modules/_io/textio.c:2307:19
    #10 0x55ceae2253bd in method_vectorcall_FASTCALL /home/boss/projects/oss/cpython/main/Objects/descrobject.c:402:24
    #11 0x55ceae1e0015 in _PyObject_VectorcallTstate /home/boss/projects/oss/cpython/main/./Include/internal/pycore_call.h:144:11
    #12 0x55ceae7347b0 in _Py_VectorCallInstrumentation_StackRefSteal /home/boss/projects/oss/cpython/main/Python/ceval.c:770:11
    #13 0x55ceae789be1 in _PyEval_EvalFrameDefault /home/boss/projects/oss/cpython/main/Python/generated_cases.c.h:1906:35
    #14 0x55ceae733500 in _PyEval_Vector /home/boss/projects/oss/cpython/main/Python/ceval.c:2176:12
    #15 0x55ceae733500 in PyEval_EvalCode /home/boss/projects/oss/cpython/main/Python/ceval.c:681:21
    #16 0x55ceaea8600a in run_eval_code_obj /home/boss/projects/oss/cpython/main/Python/pythonrun.c:1406:12
    #17 0x55ceaea85731 in run_mod /home/boss/projects/oss/cpython/main/Python/pythonrun.c:1509:19
    #18 0x55ceaea8023f in _PyRun_File /home/boss/projects/oss/cpython/main/Python/pythonrun.c:1332:15
    #19 0x55ceaea7e484 in _PyRun_SimpleFile /home/boss/projects/oss/cpython/main/Python/pythonrun.c:544:15
    #20 0x55ceaea7da5c in _PyRun_AnyFile /home/boss/projects/oss/cpython/main/Python/pythonrun.c:92:18
    #21 0x55ceaeb477df in pymain_run_file_obj /home/boss/projects/oss/cpython/main/Modules/main.c:478:24
    #22 0x55ceaeb477df in pymain_run_file /home/boss/projects/oss/cpython/main/Modules/main.c:494:20
    #23 0x55ceaeb45ecf in pymain_run_python /home/boss/projects/oss/cpython/main/Modules/main.c:804:21
    #24 0x55ceaeb45ecf in Py_RunMain /home/boss/projects/oss/cpython/main/Modules/main.c:891:5
    #25 0x55ceaeb46f1f in pymain_main /home/boss/projects/oss/cpython/main/Modules/main.c:921:12
    #26 0x55ceaeb471ac in Py_BytesMain /home/boss/projects/oss/cpython/main/Modules/main.c:945:12
    #27 0x7f921a027780  (/usr/lib/libc.so.6+0x27780) (BuildId: 503200d7fda94a5dc6058d7e0694e5d1dcb2e372)
    #28 0x7f921a0278b8 in __libc_start_main (/usr/lib/libc.so.6+0x278b8) (BuildId: 503200d7fda94a5dc6058d7e0694e5d1dcb2e372)
    #29 0x55ceadc65ba4 in _start (/home/boss/projects/oss/cpython/main/python+0xd7fba4) (BuildId: e8f674f857eaf5155b065c373ade82343fe5b882)

0x7c9219425e90 is located 80 bytes inside of 192-byte region [0x7c9219425e40,0x7c9219425f00)
freed by thread T0 here:
    #0 0x55ceadd71ff1 in free.part.0 (/home/boss/projects/oss/cpython/main/python+0xe8bff1) (BuildId: e8f674f857eaf5155b065c373ade82343fe5b882)
    #1 0x55ceae403bb8 in _PyMem_DebugRawFree /home/boss/projects/oss/cpython/main/Objects/obmalloc.c:3171:5
    #2 0x55ceaec61815 in buffered_dealloc /home/boss/projects/oss/cpython/main/./Modules/_io/bufferedio.c:444:5
    #3 0x55ceae3c2a17 in _Py_Dealloc /home/boss/projects/oss/cpython/main/Objects/object.c:3334:5
    #4 0x55ceae75967a in PyStackRef_XCLOSE /home/boss/projects/oss/cpython/main/./Include/internal/pycore_stackref.h:726:9
    #5 0x55ceae75967a in _PyEval_EvalFrameDefault /home/boss/projects/oss/cpython/main/Python/generated_cases.c.h:11163:13
    #6 0x55ceae733a1d in _PyEval_Vector /home/boss/projects/oss/cpython/main/Python/ceval.c:2176:12
    #7 0x55ceae1e0015 in _PyObject_VectorcallTstate /home/boss/projects/oss/cpython/main/./Include/internal/pycore_call.h:144:11
    #8 0x55ceae1e7119 in PyObject_VectorcallMethod /home/boss/projects/oss/cpython/main/Objects/call.c
    #9 0x55ceaec690d2 in PyObject_CallMethodOneArg /home/boss/projects/oss/cpython/main/./Include/cpython/abstract.h:74:12
    #10 0x55ceaec690d2 in _bufferedreader_raw_read /home/boss/projects/oss/cpython/main/./Modules/_io/bufferedio.c:1640:15
    #11 0x55ceaec70821 in _io__Buffered_read1_impl /home/boss/projects/oss/cpython/main/./Modules/_io/bufferedio.c:1080:20
    #12 0x55ceaec70821 in _io__Buffered_read1 /home/boss/projects/oss/cpython/main/./Modules/_io/clinic/bufferedio.c.h:721:20
    #13 0x55ceae2253bd in method_vectorcall_FASTCALL /home/boss/projects/oss/cpython/main/Objects/descrobject.c:402:24
    #14 0x55ceae1e0015 in _PyObject_VectorcallTstate /home/boss/projects/oss/cpython/main/./Include/internal/pycore_call.h:144:11
    #15 0x55ceae1e7119 in PyObject_VectorcallMethod /home/boss/projects/oss/cpython/main/Objects/call.c
    #16 0x55ceaec98362 in PyObject_CallMethodOneArg /home/boss/projects/oss/cpython/main/./Include/cpython/abstract.h:74:12
    #17 0x55ceaec98362 in buffer_callmethod_onearg /home/boss/projects/oss/cpython/main/./Modules/_io/textio.c:792:12
    #18 0x55ceaec98362 in textiowrapper_read_chunk /home/boss/projects/oss/cpython/main/./Modules/_io/textio.c:1996:19
    #19 0x55ceaec95a83 in _textiowrapper_readline /home/boss/projects/oss/cpython/main/./Modules/_io/textio.c:2307:19
    #20 0x55ceae2253bd in method_vectorcall_FASTCALL /home/boss/projects/oss/cpython/main/Objects/descrobject.c:402:24
    #21 0x55ceae1e0015 in _PyObject_VectorcallTstate /home/boss/projects/oss/cpython/main/./Include/internal/pycore_call.h:144:11
    #22 0x55ceae7347b0 in _Py_VectorCallInstrumentation_StackRefSteal /home/boss/projects/oss/cpython/main/Python/ceval.c:770:11
    #23 0x55ceae789be1 in _PyEval_EvalFrameDefault /home/boss/projects/oss/cpython/main/Python/generated_cases.c.h:1906:35
    #24 0x55ceae733500 in _PyEval_Vector /home/boss/projects/oss/cpython/main/Python/ceval.c:2176:12
    #25 0x55ceae733500 in PyEval_EvalCode /home/boss/projects/oss/cpython/main/Python/ceval.c:681:21
    #26 0x55ceaea8600a in run_eval_code_obj /home/boss/projects/oss/cpython/main/Python/pythonrun.c:1406:12
    #27 0x55ceaea85731 in run_mod /home/boss/projects/oss/cpython/main/Python/pythonrun.c:1509:19
    #28 0x55ceaea8023f in _PyRun_File /home/boss/projects/oss/cpython/main/Python/pythonrun.c:1332:15
    #29 0x55ceaea7e484 in _PyRun_SimpleFile /home/boss/projects/oss/cpython/main/Python/pythonrun.c:544:15
    #30 0x55ceaea7da5c in _PyRun_AnyFile /home/boss/projects/oss/cpython/main/Python/pythonrun.c:92:18
    #31 0x55ceaeb477df in pymain_run_file_obj /home/boss/projects/oss/cpython/main/Modules/main.c:478:24
    #32 0x55ceaeb477df in pymain_run_file /home/boss/projects/oss/cpython/main/Modules/main.c:494:20
    #33 0x55ceaeb45ecf in pymain_run_python /home/boss/projects/oss/cpython/main/Modules/main.c:804:21
    #34 0x55ceaeb45ecf in Py_RunMain /home/boss/projects/oss/cpython/main/Modules/main.c:891:5
    #35 0x55ceaeb46f1f in pymain_main /home/boss/projects/oss/cpython/main/Modules/main.c:921:12
    #36 0x55ceaeb471ac in Py_BytesMain /home/boss/projects/oss/cpython/main/Modules/main.c:945:12
    #37 0x7f921a027780  (/usr/lib/libc.so.6+0x27780) (BuildId: 503200d7fda94a5dc6058d7e0694e5d1dcb2e372)

previously allocated by thread T0 here:
    #0 0x55ceadd72f91 in malloc (/home/boss/projects/oss/cpython/main/python+0xe8cf91) (BuildId: e8f674f857eaf5155b065c373ade82343fe5b882)
    #1 0x55ceae409b67 in _PyMem_DebugRawAlloc /home/boss/projects/oss/cpython/main/Objects/obmalloc.c:3103:24
    #2 0x55ceae471758 in _PyObject_MallocWithType /home/boss/projects/oss/cpython/main/./Include/internal/pycore_object_alloc.h:46:17
    #3 0x55ceae471758 in _PyType_AllocNoTrack /home/boss/projects/oss/cpython/main/Objects/typeobject.c:2498:19
    #4 0x55ceae47143d in PyType_GenericAlloc /home/boss/projects/oss/cpython/main/Objects/typeobject.c:2529:21
    #5 0x55ceae491199 in object_new /home/boss/projects/oss/cpython/main/Objects/typeobject.c:7355:21
    #6 0x55ceae488fe9 in type_call /home/boss/projects/oss/cpython/main/Objects/typeobject.c:2442:11
    #7 0x55ceae1e09d2 in _PyObject_MakeTpCall /home/boss/projects/oss/cpython/main/Objects/call.c:242:18
    #8 0x55ceae7347b0 in _Py_VectorCallInstrumentation_StackRefSteal /home/boss/projects/oss/cpython/main/Python/ceval.c:770:11
    #9 0x55ceae789be1 in _PyEval_EvalFrameDefault /home/boss/projects/oss/cpython/main/Python/generated_cases.c.h:1906:35
    #10 0x55ceae733500 in _PyEval_Vector /home/boss/projects/oss/cpython/main/Python/ceval.c:2176:12
    #11 0x55ceae733500 in PyEval_EvalCode /home/boss/projects/oss/cpython/main/Python/ceval.c:681:21
    #12 0x55ceaea8600a in run_eval_code_obj /home/boss/projects/oss/cpython/main/Python/pythonrun.c:1406:12
    #13 0x55ceaea85731 in run_mod /home/boss/projects/oss/cpython/main/Python/pythonrun.c:1509:19
    #14 0x55ceaea8023f in _PyRun_File /home/boss/projects/oss/cpython/main/Python/pythonrun.c:1332:15
    #15 0x55ceaea7e484 in _PyRun_SimpleFile /home/boss/projects/oss/cpython/main/Python/pythonrun.c:544:15
    #16 0x55ceaea7da5c in _PyRun_AnyFile /home/boss/projects/oss/cpython/main/Python/pythonrun.c:92:18
    #17 0x55ceaeb477df in pymain_run_file_obj /home/boss/projects/oss/cpython/main/Modules/main.c:478:24
    #18 0x55ceaeb477df in pymain_run_file /home/boss/projects/oss/cpython/main/Modules/main.c:494:20
    #19 0x55ceaeb45ecf in pymain_run_python /home/boss/projects/oss/cpython/main/Modules/main.c:804:21
    #20 0x55ceaeb45ecf in Py_RunMain /home/boss/projects/oss/cpython/main/Modules/main.c:891:5
    #21 0x55ceaeb46f1f in pymain_main /home/boss/projects/oss/cpython/main/Modules/main.c:921:12
    #22 0x55ceaeb471ac in Py_BytesMain /home/boss/projects/oss/cpython/main/Modules/main.c:945:12
    #23 0x7f921a027780  (/usr/lib/libc.so.6+0x27780) (BuildId: 503200d7fda94a5dc6058d7e0694e5d1dcb2e372)
    #24 0x7f921a0278b8 in __libc_start_main (/usr/lib/libc.so.6+0x278b8) (BuildId: 503200d7fda94a5dc6058d7e0694e5d1dcb2e372)
    #25 0x55ceadc65ba4 in _start (/home/boss/projects/oss/cpython/main/python+0xd7fba4) (BuildId: e8f674f857eaf5155b065c373ade82343fe5b882)

SUMMARY: AddressSanitizer: heap-use-after-free /home/boss/projects/oss/cpython/main/./Modules/_io/bufferedio.c:1667:24 in _bufferedreader_raw_read
Shadow bytes around the buggy address:
  0x7c9219425c00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x7c9219425c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c9219425d00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x7c9219425d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa
  0x7c9219425e00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x7c9219425e80: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7c9219425f00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x7c9219425f80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7c9219426000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x7c9219426080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7c9219426100: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==176750==ABORTING

@cmaloney

@cmaloney @vstinner

Merge branch 'main' into pythongh-157364

@picnixz

@picnixz Confirmed and reproduced on 3.14 and 3.15 (both GIL and free-threaded). Earlier branches (3.10–3.13) fail to build locally due to unrelated ASan/UBSan errors

gh-157364: Fix use-after-free in io.TextIOWrapper during reentrant de…

Navigation Menu

Repository navigation

io.TextIOWrapper UAF triggered by readline() #157364

Bug report

Bug description:

CPython versions tested on:

Operating systems tested on:

Linked PRs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

io.TextIOWrapper UAF triggered by readline() #157364

Description

Bug report

Bug description:

CPython versions tested on:

Operating systems tested on:

Linked PRs

Activity

djarfluka commented on Sep 12, 2026

picnixz commented on Sep 12, 2026

ashm-dev commented on Sep 12, 2026

ashm-dev commented on Sep 12, 2026

picnixz commented on Sep 12, 2026

ashm-dev commented on Sep 12, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions