heap buffer overflow in ast _copy_characters #140492
Description
Crash report
What happened?
could be related to #140471
import ast
import unittest
class ASTConstructorTests(unittest.TestCase):
def test_fields_and_types_no_default(self):
class FieldsAndTypesNoDefault(ast.AST):
_fields = (b'\xff'*64,)
_field_types = {'a': int}
with self.assertRaises(TypeError):
FieldsAndTypesNoDefault()
if __name__ == "__main__":
unittest.main()=================================================================
==2418698==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50b000019590 at pc 0x5f657c332a6b bp 0x7ffdb21fd570 sp 0x7ffdb21fd560
READ of size 4 at 0x50b000019590 thread T0
#0 0x5f657c332a6a in _copy_characters ../Objects/unicodeobject.c:1526
#1 0x5f657c38f5bc in _PyUnicode_FastCopyCharacters ../Objects/unicodeobject.c:1558
#2 0x5f657c38f5bc in _PyUnicodeWriter_WriteStr ../Objects/unicodeobject.c:13754
#3 0x5f657c39844d in unicode_fromformat_arg ../Objects/unicodeobject.c:2991
#4 0x5f657c39844d in unicode_from_format ../Objects/unicodeobject.c:3165
#5 0x5f657c39b1da in PyUnicode_FromFormatV ../Objects/unicodeobject.c:3199
#6 0x5f657c3d4ec2 in _PyErr_WarnFormatV ../Python/_warnings.c:1379
#7 0x5f657c3d4ec2 in PyErr_WarnFormat ../Python/_warnings.c:1396
#8 0x5f657c3fe40b in ast_type_init ../Python/Python-ast.c:5329
#9 0x5f657c2b9f67 in type_call ../Objects/typeobject.c:2460
#10 0x5f657c11b78d in _PyObject_MakeTpCall ../Objects/call.c:242
#11 0x5f657bfdb388 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#12 0x5f657c49bbb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#13 0x5f657c49bbb5 in _PyEval_Vector ../Python/ceval.c:2001
#14 0x5f657c126dc0 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#15 0x5f657c126dc0 in method_vectorcall ../Objects/classobject.c:95
#16 0x5f657c1222be in _PyVectorcall_Call ../Objects/call.c:273
#17 0x5f657c1222be in _PyObject_Call ../Objects/call.c:348
#18 0x5f657c1222be in PyObject_Call ../Objects/call.c:373
#19 0x5f657bfc2f67 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#20 0x5f657c49bbb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#21 0x5f657c49bbb5 in _PyEval_Vector ../Python/ceval.c:2001
#22 0x5f657c1208e3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#23 0x5f657c120f9c in _PyObject_Call_Prepend ../Objects/call.c:504
#24 0x5f657c2d78e4 in call_method ../Objects/typeobject.c:3076
#25 0x5f657c2d78e4 in slot_tp_call ../Objects/typeobject.c:10599
#26 0x5f657c11b78d in _PyObject_MakeTpCall ../Objects/call.c:242
#27 0x5f657bfc085c in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#28 0x5f657c49bbb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#29 0x5f657c49bbb5 in _PyEval_Vector ../Python/ceval.c:2001
#30 0x5f657c126dc0 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#31 0x5f657c126dc0 in method_vectorcall ../Objects/classobject.c:95
#32 0x5f657c1222be in _PyVectorcall_Call ../Objects/call.c:273
#33 0x5f657c1222be in _PyObject_Call ../Objects/call.c:348
#34 0x5f657c1222be in PyObject_Call ../Objects/call.c:373
#35 0x5f657bfc2f67 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#36 0x5f657c49bbb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#37 0x5f657c49bbb5 in _PyEval_Vector ../Python/ceval.c:2001
#38 0x5f657c1208e3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#39 0x5f657c120f9c in _PyObject_Call_Prepend ../Objects/call.c:504
#40 0x5f657c2d78e4 in call_method ../Objects/typeobject.c:3076
#41 0x5f657c2d78e4 in slot_tp_call ../Objects/typeobject.c:10599
#42 0x5f657c11b78d in _PyObject_MakeTpCall ../Objects/call.c:242
#43 0x5f657bfbfb82 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#44 0x5f657c49bbb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#45 0x5f657c49bbb5 in _PyEval_Vector ../Python/ceval.c:2001
#46 0x5f657c126dc0 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#47 0x5f657c126dc0 in method_vectorcall ../Objects/classobject.c:95
#48 0x5f657c1222be in _PyVectorcall_Call ../Objects/call.c:273
#49 0x5f657c1222be in _PyObject_Call ../Objects/call.c:348
#50 0x5f657c1222be in PyObject_Call ../Objects/call.c:373
#51 0x5f657bfc2f67 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#52 0x5f657c49bbb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#53 0x5f657c49bbb5 in _PyEval_Vector ../Python/ceval.c:2001
#54 0x5f657c1208e3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#55 0x5f657c120f9c in _PyObject_Call_Prepend ../Objects/call.c:504
#56 0x5f657c2d78e4 in call_method ../Objects/typeobject.c:3076
#57 0x5f657c2d78e4 in slot_tp_call ../Objects/typeobject.c:10599
#58 0x5f657c11b78d in _PyObject_MakeTpCall ../Objects/call.c:242
#59 0x5f657bfbfb82 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#60 0x5f657c49bbb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#61 0x5f657c49bbb5 in _PyEval_Vector ../Python/ceval.c:2001
#62 0x5f657c1208e3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#63 0x5f657c120f9c in _PyObject_Call_Prepend ../Objects/call.c:504
#64 0x5f657c2c6da0 in call_method ../Objects/typeobject.c:3076
#65 0x5f657c2c6da0 in slot_tp_init ../Objects/typeobject.c:10828
#66 0x5f657c2b9f67 in type_call ../Objects/typeobject.c:2460
#67 0x5f657c11b78d in _PyObject_MakeTpCall ../Objects/call.c:242
#68 0x5f657bfdb388 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#69 0x5f657c49b3e6 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#70 0x5f657c49b3e6 in _PyEval_Vector ../Python/ceval.c:2001
#71 0x5f657c49b3e6 in PyEval_EvalCode ../Python/ceval.c:884
#72 0x5f657c5e0cce in run_eval_code_obj ../Python/pythonrun.c:1365
#73 0x5f657c5e0cce in run_mod ../Python/pythonrun.c:1459
#74 0x5f657c5e5977 in pyrun_file ../Python/pythonrun.c:1293
#75 0x5f657c5e5977 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#76 0x5f657c5e649c in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#77 0x5f657c6597fc in pymain_run_file_obj ../Modules/main.c:410
#78 0x5f657c6597fc in pymain_run_file ../Modules/main.c:429
#79 0x5f657c6597fc in pymain_run_python ../Modules/main.c:691
#80 0x5f657c65b0de in Py_RunMain ../Modules/main.c:772
#81 0x5f657c65b0de in pymain_main ../Modules/main.c:802
#82 0x5f657c65b0de in Py_BytesMain ../Modules/main.c:826
#83 0x75dd51f291c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#84 0x75dd51f2928a in __libc_start_main_impl ../csu/libc-start.c:360
#85 0x5f657bff5524 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython-normal/build/python+0x20e524) (BuildId: b922665a0e7afc8ee52df7c3eac25a643025109e)
0x50b000019591 is located 0 bytes after 97-byte region [0x50b000019530,0x50b000019591)
allocated by thread T0 here:
#0 0x75dd522f79c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5f657c10e2d5 in bytes_repeat ../Objects/bytesobject.c:1521
#2 0x5f657c518dff in const_folding_safe_multiply ../Python/flowgraph.c:1727
#3 0x5f657c518dff in eval_const_binop ../Python/flowgraph.c:1795
#4 0x5f657c518dff in fold_const_binop ../Python/flowgraph.c:1867
#5 0x5f657c518dff in optimize_basic_block ../Python/flowgraph.c:2489
#6 0x5f657c51be2d in optimize_cfg ../Python/flowgraph.c:2543
#7 0x5f657c51be2d in _PyCfg_OptimizeCodeUnit ../Python/flowgraph.c:3655
#8 0x5f657c4ddcd9 in optimize_and_assemble_code_unit ../Python/compile.c:1432
#9 0x5f657c4ddcd9 in _PyCompile_OptimizeAndAssemble ../Python/compile.c:1474
#10 0x5f657c4cd1a7 in codegen_class_body ../Python/codegen.c:1605
#11 0x5f657c4cd1a7 in codegen_class ../Python/codegen.c:1662
#12 0x5f657c4c5bc9 in codegen_visit_stmt ../Python/codegen.c:3008
#13 0x5f657c4d386a in codegen_function_body ../Python/codegen.c:1382
#14 0x5f657c4d386a in codegen_function ../Python/codegen.c:1480
#15 0x5f657c4c5bf3 in codegen_visit_stmt ../Python/codegen.c:3095
#16 0x5f657c4cadd6 in codegen_body ../Python/codegen.c:911
#17 0x5f657c4ccf42 in codegen_class_body ../Python/codegen.c:1569
#18 0x5f657c4ccf42 in codegen_class ../Python/codegen.c:1662
#19 0x5f657c4c5bc9 in codegen_visit_stmt ../Python/codegen.c:3008
#20 0x5f657c4cadd6 in codegen_body ../Python/codegen.c:911
#21 0x5f657c4d6094 in _PyCodegen_Module ../Python/codegen.c:874
#22 0x5f657c4d7d18 in compiler_codegen ../Python/compile.c:835
#23 0x5f657c4de481 in compiler_mod ../Python/compile.c:856
#24 0x5f657c4de481 in _PyAST_Compile ../Python/compile.c:1487
#25 0x5f657c5e0e1c in run_mod ../Python/pythonrun.c:1411
#26 0x5f657c5e5977 in pyrun_file ../Python/pythonrun.c:1293
#27 0x5f657c5e5977 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#28 0x5f657c5e649c in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#29 0x5f657c6597fc in pymain_run_file_obj ../Modules/main.c:410
#30 0x5f657c6597fc in pymain_run_file ../Modules/main.c:429
#31 0x5f657c6597fc in pymain_run_python ../Modules/main.c:691
#32 0x5f657c65b0de in Py_RunMain ../Modules/main.c:772
#33 0x5f657c65b0de in pymain_main ../Modules/main.c:802
#34 0x5f657c65b0de in Py_BytesMain ../Modules/main.c:826
#35 0x75dd51f291c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#36 0x75dd51f2928a in __libc_start_main_impl ../csu/libc-start.c:360
#37 0x5f657bff5524 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython-normal/build/python+0x20e524) (BuildId: b922665a0e7afc8ee52df7c3eac25a643025109e)
SUMMARY: AddressSanitizer: heap-buffer-overflow ../Objects/unicodeobject.c:1526 in _copy_characters
Shadow bytes around the buggy address:
0x50b000019300: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
0x50b000019380: 03 fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd
0x50b000019400: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
0x50b000019480: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
0x50b000019500: fa fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00
=>0x50b000019580: 00 00[01]fa fa fa fa fa fa fa fa fa fd fd fd fd
0x50b000019600: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
0x50b000019680: fa fa fd fd fd fd fd fd fd fd fd fd fd fd fd fa
0x50b000019700: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x50b000019780: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fd fd
0x50b000019800: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2418698==ABORTING
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Output from running 'python -VV' on the command line:
No response