[issue42422] Py_Decref on value crash the interpreter in Python/ceval.c:1104

STINNER Victor added the comment: About PR 23448: I don't see the value of adding a script just prove that CPython has no bytecode verifier. If you consider that it's not well documented, it should be documented in the types.CodeType documentation: https://docs.python.org/dev/library/types.h

[issue42422] Py_Decref on value crash the interpreter in Python/ceval.c:1104

Batuhan Taskaya added the comment: > I would be happy to update and fix it instead if you think it's better that > way. Please let me know, it will be great to see my first submission being > treated. Yes, please. That seems more appropriate -- _

[issue42422] Py_Decref on value crash the interpreter in Python/ceval.c:1104

Dennis Sweeney added the comment: Why not just fix bogus_code_obj.py? Something like this (using the replace method) would make it more future-proof to similar changes in the code object constructor signature (and be more readable!): import dis POP_TOP = dis.opmap['POP_TOP'] wordcode = byte

[issue42422] Py_Decref on value crash the interpreter in Python/ceval.c:1104

Sofian Brabez added the comment: Any ETA? I would appreciate to see my contribution being merged. Batuhan, the current code is not doing what it's supposed to do in bogus_code_obj.py (i.e. no crash after 3.8 and above in master and branches). This still make the issue valid I guess. ``` $ .

[issue42422] Py_Decref on value crash the interpreter in Python/ceval.c:1104

Batuhan Taskaya added the comment: > do you think this is too similar to bogus_code_obj.py? That's the only > crasher I can see it being similar to. As far as I assume, yes, that is the generic VM crasher via custom code object execution. I feel its existence is good enough to answer to issu

[issue42422] Py_Decref on value crash the interpreter in Python/ceval.c:1104

Eric V. Smith added the comment: @BTaskaya: do you think this is too similar to bogus_code_obj.py? That's the only crasher I can see it being similar to. -- versions: +Python 3.10 -Python 3.6, Python 3.7 ___ Python tracker

[issue42422] Py_Decref on value crash the interpreter in Python/ceval.c:1104

Batuhan Taskaya added the comment: I'm sorry to interrupt but what is the exact reasoning behind adding a new, (I presume) redundant crasher? There are tons of different ways to crash the interpreter with malformed bytecode, how would adding only one of them bring any good? -- nosy:

[issue42422] Py_Decref on value crash the interpreter in Python/ceval.c:1104

Change by Eric V. Smith : -- nosy: +eric.smith ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.p

[issue42422] Py_Decref on value crash the interpreter in Python/ceval.c:1104

Change by Sofian Brabez : -- pull_requests: +22340 stage: -> patch review pull_request: https://github.com/python/cpython/pull/23448 ___ Python tracker ___ ___

[issue42422] Py_Decref on value crash the interpreter in Python/ceval.c:1104

Sofian Brabez added the comment: Thanks Dennis for pointing me the crashers, I was not aware of them. I have added a new crash test to cover multiple crashes in different interpreter versions. Current bogus does not crash where it could be possible to crash in older and newer interpreter ver

[issue42422] Py_Decref on value crash the interpreter in Python/ceval.c:1104

Dennis Sweeney added the comment: >From >https://github.com/python/cpython/blob/master/Lib/test/crashers/bogus_code_obj.py > : """ Broken bytecode objects can easily crash the interpreter. This is not going to be fixed. It is generally agreed that there is no point in writing a bytecode veri

[issue42422] Py_Decref on value crash the interpreter in Python/ceval.c:1104

Sofian Brabez added the comment: Linux, FreeBSD and MacOSX crash reports and backtraces joined in the zip. Contributor Agreement 2020-09-23 signed. -- Added file: https://bugs.python.org/file49611/crash-report-txt.zip ___ Python tracker

[issue42422] Py_Decref on value crash the interpreter in Python/ceval.c:1104

New submission from Sofian Brabez : This PoC is causing a local crash of python interpreters version 2.7,3.6,3.7,3.8 and 3.9. By creating a code object of size 0 with a POP_TOP opcode, in Python/ceval.c the call to Py_DECREF(value) on a NULL pointer lead to a segmentation fault of the python