Skip to content

with a as b segfault in new peg parser #85232

New issue
New issue
Closed
Closed
with a as b segfault in new peg parser#85232
Assignees
lysnikolaou
Labels
3.10 (EOL)end of life3.9 (EOL)end of lifeinterpreter-core(Objects, Python, Grammar, and Parser dirs)type-crashA hard crash of the interpreter, possibly with a core dump

Description

@stestagg
stestagg
mannequin
opened on Jun 20, 2020
BPO 41060
Nosy @gvanrossum, @lysnikolaou, @pablogsal, @miss-islington, @stestagg
PRs
  • bpo-41060: Avoid SEGFAULT when calling GET_INVALID_TARGET in the grammar #21020
  • [3.9] bpo-41060: Avoid SEGFAULT when calling GET_INVALID_TARGET in the grammar (GH-21020) #21024
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = 'https://github.com/lysnikolaou'
closed_at = <Date 2020-06-21.02:30:45.455>
created_at = <Date 2020-06-20.21:36:11.100>
labels = ['interpreter-core', '3.10', '3.9', 'type-crash']
title = '`with a as b` segfault in new peg parser'
updated_at = <Date 2020-06-21.02:47:28.773>
user = 'https://github.com/stestagg'

    bugs.python.org fields:

    activity = <Date 2020-06-21.02:47:28.773>
actor = 'miss-islington'
assignee = 'lys.nikolaou'
closed = True
closed_date = <Date 2020-06-21.02:30:45.455>
closer = 'lys.nikolaou'
components = ['Interpreter Core']
creation = <Date 2020-06-20.21:36:11.100>
creator = 'stestagg'
dependencies = []
files = []
hgrepos = []
issue_num = 41060
keywords = ['patch']
message_count = 6.0
messages = ['371964', '371965', '371970', '371972', '371978', '371979']
nosy_count = 5.0
nosy_names = ['gvanrossum', 'lys.nikolaou', 'pablogsal', 'miss-islington', 'stestagg']
pr_nums = ['21020', '21024']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue41060'
versions = ['Python 3.9', 'Python 3.10']

    Activity

    1. stestagg commented on Jun 20, 2020

      @stestagg
      stestaggmannequin
      on Jun 20, 2020
      MannequinAuthor

      Hi

      Fuzzing found the following:

      $ ./python/bin/python3
Python 3.10.0a0 (heads/master:eb0d5c38de, Jun 20 2020, 21:35:36) 
[Clang 10.0.0 ] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> with a as b
fish: “./python/bin/python3” terminated by signal SIGSEGV (Address boundary error)
      with stacktrace:
* thread #1, name = 'run', stop reason = signal SIGSEGV: invalid address (fault address: 0x20)
  * frame #0: 0x0000555555a08feb run`with_item_rule at parser.c:15382:20
    frame #1: 0x0000555555a08e96 run`with_item_rule(p=0x00007ffff78b9e40) at parser.c:4330
    frame #2: 0x00005555559d22e9 run`compound_stmt_rule at parser.c:17930:21
    frame #3: 0x00005555559d227c run`compound_stmt_rule at parser.c:4139
    frame #4: 0x00005555559d1a64 run`compound_stmt_rule(p=<unavailable>) at parser.c:1931
    frame #5: 0x00005555559d016c run`statements_rule at parser.c:1230:18
    frame #6: 0x00005555559d00fb run`statements_rule at parser.c:16156
    frame #7: 0x00005555559cff4d run`statements_rule(p=<unavailable>) at parser.c:1189
    frame #8: 0x00005555559cb2bc run`_PyPegen_parse at parser.c:722:18
    frame #9: 0x00005555559cb28d run`_PyPegen_parse(p=0x00007ffff78b9e40) at parser.c:24688
    frame #10: 0x00005555559c5349 run`_PyPegen_run_parser(p=0x00007ffff78b9e40) at pegen.c:1083:17
    frame #11: 0x00005555559c6458 run`_PyPegen_run_parser_from_string(str=<unavailable>, start_rule=<unavailable>, filename_ob=0x00007ffff788db30, flags=<unavailable>, arena=<unavailable>) at pegen.c:1201:14
    frame #12: 0x00005555555eea84 run`PyPegen_ASTFromStringObject(str="with'lZ''</'as sdbm.N", filename=0x00007ffff788db30, mode=257, flags=0x0000000000000000, arena=0x00007ffff78e4910) at peg_api.c:27:21
    frame #13: 0x00005555555a8413 run`PyRun_StringFlags(str="with'lZ''</'as sdbm.N", start=<unavailable>, globals=0x00007ffff788d940, locals=0x00007ffff788d940, flags=0x0000000000000000) at pythonrun.c:1029:11
    frame #14: 0x00005555555a8202 run`PyRun_SimpleStringFlags(command="with'lZ''</'as sdbm.N", flags=0x0000000000000000) at pythonrun.c:429:9
    frame #15: 0x0000555555595936 run`main(argc=<unavailable>, argv=<unavailable>) at run.c:19:3
    frame #16: 0x00007ffff7c35002 libc.so.6`__libc_start_main + 242
    frame #17: 0x000055555559568e run`_start + 46

      This appears to be similar to: https://bugs.python.org/issue40903, where GET_INVALID_TARGET is being called with an Attribute Node, which returns None, and this result is passed, unchecked into PyPegen_get_expr_name

    2. stestagg
      added
      3.9 (EOL)end of life
      3.10 (EOL)end of life
      interpreter-core(Objects, Python, Grammar, and Parser dirs)
      type-crashA hard crash of the interpreter, possibly with a core dump
      on Jun 20, 2020

    3. stestagg commented on Jun 20, 2020

      @stestagg
      stestaggmannequin
      on Jun 20, 2020
      MannequinAuthor

      Appears to have been introduced by:

      bpo-40334: Produce better error messages on invalid targets (GH-20106)
      01ece63

    4. lysnikolaou commented on Jun 20, 2020

      @lysnikolaou
      lysnikolaou
      on Jun 20, 2020
      Member

      On it.

    5. lysnikolaou
      assigned
      lysnikolaou
      on Jun 20, 2020

    6. lysnikolaou commented on Jun 20, 2020

      @lysnikolaou
      lysnikolaou
      on Jun 20, 2020
      Member

      Thanks for the report, Steve. I've now opened a PR that should fix this.

    7. pablogsal commented on Jun 21, 2020

      @pablogsal
      pablogsal
      on Jun 21, 2020
      Member

      New changeset 6c4e0bd by Lysandros Nikolaou in branch 'master':
      bpo-41060: Avoid SEGFAULT when calling GET_INVALID_TARGET in the grammar (GH-21020)
      6c4e0bd

    8. lysnikolaou
      closed this as completedon Jun 21, 2020
    9. lysnikolaou
      closed this as completedon Jun 21, 2020

    10. miss-islington commented on Jun 21, 2020

      @miss-islington
      miss-islington
      on Jun 21, 2020
      Contributor

      New changeset 71bb921 by Lysandros Nikolaou in branch '3.9':
      [3.9] bpo-41060: Avoid SEGFAULT when calling GET_INVALID_TARGET in the grammar (GH-21020) (GH-21024)
      71bb921

    11. ezio-melotti
      transferred this issue fromon Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Metadata

    Metadata

    Assignees

    Labels

    3.10 (EOL)end of life3.9 (EOL)end of lifeinterpreter-core(Objects, Python, Grammar, and Parser dirs)type-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions