python / python/cpython

heap uaf in _lsprof via enable()

Open
#157,639 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

extension-modules topic-profiling type-bug
Dominant language
Python
Stars
77.2k
Forks
35.9k
PR merge metrics
PR metrics pending

Description

Bug report

Bug description:
import _lsprof
prof = _lsprof.Profiler()
def _timer():
    try:
        prof.enable()        
    except Exception:
        pass
    return 0
prof.__init__(timer=_timer)
prof.enable()
def foo():
    return 1
foo()                 
prof.disable()               

ASAN output (truncated:

==ERROR: AddressSanitizer: heap-use-after-free ... READ of size 8
    #0 ptrace_enter_call Modules/_lsprof.c:383
    #1 _lsprof_Profiler__ccall_callback_impl Modules/_lsprof.c:733
freed by thread T0 here:
    #1 flush_unmatched Modules/_lsprof.c:873
    #2 _lsprof_Profiler_disable_impl Modules/_lsprof.c:930
previously allocated by thread T0 here:
    #1 ptrace_enter_call Modules/_lsprof.c:388
SUMMARY: AddressSanitizer: heap-use-after-free Modules/_lsprof.c:383 in ptrace_enter_call
CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs
  • gh-157648

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the report with the Python snippet under ASAN and inspect Modules/_lsprof.c, starting at ptrace_enter_call and the _lsprof_Profiler__ccall_callback_impl path. Read flush_unmatched and _lsprof_Profiler_disable_impl to trace the allocation and free sequence. Done means the reproducer no longer reports a heap-use-after-free during profiler enable/disable.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, python
Domain
performance, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.