cpython crash (heap-buffer-overflow) Python/generated_cases.c.h _PyEval_EvalFrameDefault

[YuanchengJiang]

Crash report

What happened?

def f():
    pass
f.__code__ = f.__code__.replace(co_code=b"")
f()

=================================================================
==503928==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x511000058090 at pc 0x58d595b32156 bp 0x7fff9b688d90 sp 0x7fff9b688d80
READ of size 2 at 0x511000058090 thread T0
    #0 0x58d595b32155 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:12265
    #1 0x58d595fe4386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
    #2 0x58d595fe4386 in _PyEval_Vector ../Python/ceval.c:2001
    #3 0x58d595fe4386 in PyEval_EvalCode ../Python/ceval.c:884
    #4 0x58d5961a2f0e in run_eval_code_obj ../Python/pythonrun.c:1365
    #5 0x58d5961a2f0e in run_mod ../Python/pythonrun.c:1459
    #6 0x58d5961a7bb7 in pyrun_file ../Python/pythonrun.c:1293
    #7 0x58d5961a7bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
    #8 0x58d5961a86dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
    #9 0x58d59621bafc in pymain_run_file_obj ../Modules/main.c:410
    #10 0x58d59621bafc in pymain_run_file ../Modules/main.c:429
    #11 0x58d59621bafc in pymain_run_python ../Modules/main.c:691
    #12 0x58d59621d3de in Py_RunMain ../Modules/main.c:772
    #13 0x58d59621d3de in pymain_main ../Modules/main.c:802
    #14 0x58d59621d3de in Py_BytesMain ../Modules/main.c:826
    #15 0x7360ed33e1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
    #16 0x7360ed33e28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
    #17 0x58d595b37fa4 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x21afa4) (BuildId: f28384d3eff6aa8d5f0c5730194edf28c0f6b3bd)

0x511000058090 is located 0 bytes after 208-byte region [0x511000057fc0,0x511000058090)
allocated by thread T0 here:
    #0 0x7360ed70c9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x58d595d7f330 in _PyObject_NewVar ../Objects/object.c:566
    #2 0x58d595c70c76 in _PyCode_New ../Objects/codeobject.c:732
    #3 0x58d595c72bfe in PyUnstable_Code_NewWithPosOnlyArgs ../Objects/codeobject.c:901
    #4 0x58d595c7af1c in PyCode_NewWithPosOnlyArgs ../Include/cpython/code.h:211
    #5 0x58d595c7af1c in code_replace_impl ../Objects/codeobject.c:2827
    #6 0x58d595c7af1c in code_replace ../Objects/clinic/codeobject.c.h:405
    #7 0x58d595c5fee7 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
    #8 0x58d595c5fee7 in PyObject_Vectorcall ../Objects/call.c:327
    #9 0x58d595b03bc2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2920
    #10 0x58d595fe4386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
    #11 0x58d595fe4386 in _PyEval_Vector ../Python/ceval.c:2001
    #12 0x58d595fe4386 in PyEval_EvalCode ../Python/ceval.c:884
    #13 0x58d5961a2f0e in run_eval_code_obj ../Python/pythonrun.c:1365
    #14 0x58d5961a2f0e in run_mod ../Python/pythonrun.c:1459
    #15 0x58d5961a7bb7 in pyrun_file ../Python/pythonrun.c:1293
    #16 0x58d5961a7bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
    #17 0x58d5961a86dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
    #18 0x58d59621bafc in pymain_run_file_obj ../Modules/main.c:410
    #19 0x58d59621bafc in pymain_run_file ../Modules/main.c:429
    #20 0x58d59621bafc in pymain_run_python ../Modules/main.c:691
    #21 0x58d59621d3de in Py_RunMain ../Modules/main.c:772
    #22 0x58d59621d3de in pymain_main ../Modules/main.c:802
    #23 0x58d59621d3de in Py_BytesMain ../Modules/main.c:826
    #24 0x7360ed33e1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
    #25 0x7360ed33e28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
    #26 0x58d595b37fa4 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x21afa4) (BuildId: f28384d3eff6aa8d5f0c5730194edf28c0f6b3bd)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../Python/generated_cases.c.h:12265 in _PyEval_EvalFrameDefault
Shadow bytes around the buggy address:
  0x511000057e00: 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x511000057e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x511000057f00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x511000057f80: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x511000058000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x511000058080: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x511000058100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x511000058180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x511000058200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x511000058280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x511000058300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==503928==ABORTING

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

No response

[kumaraditya303]

This is a known crasher https://github.com/python/cpython/blob/main/Lib/test/crashers/bogus_code_obj.py