mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-07-23 11:15:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

[3.14] gh-134100: Fix use-after-free in PyImport_ImportModuleLevelObject (GH-134117) (#134171)

Browse source 
gh-134100: Fix use-after-free in `PyImport_ImportModuleLevelObject` (GH-134117)
(cherry picked from commit 4e9005d32f)

Co-authored-by: Nico-Posada <102486290+Nico-Posada@users.noreply.github.com>
This commit is contained in:
Miss Islington (bot) 2025-05-18 17:08:40 +02:00 • committed by GitHub
parent bf39decabd
commit 8d51ed6b05
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 20 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

15
Lib/test/test_importlib/import_/test_relative_imports.py
View file

@ -223,6 +223,21 @@ class RelativeImports:
self.__import__('sys', {'__package__': '', '__spec__': None},
level=1)
def test_malicious_relative_import(self):
# https://github.com/python/cpython/issues/134100
# Test to make sure UAF bug with error msg doesn't come back to life
import sys
loooong = "".ljust(0x23000, "b")
name = f"a.{loooong}.c"
with util.uncache(name):
sys.modules[name] = {}
with self.assertRaisesRegex(
KeyError,
r"'a\.b+' not in sys\.modules as expected"
):
__import__(f"{loooong}.c", {"__package__": "a"}, level=1)
(Frozen_RelativeImports,
Source_RelativeImports

2
Misc/NEWS.d/next/Core_and_Builtins/2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst Normal file
View file

@ -0,0 +1,2 @@
Fix a use-after-free bug that occurs when an imported module isn't
in :data:`sys.modules` after its initial import. Patch by Nico-Posada.

4
Python/import.c
View file

@ -3852,15 +3852,17 @@ PyImport_ImportModuleLevelObject(PyObject *name, PyObject *globals,
}
final_mod = import_get_module(tstate, to_return);
Py_DECREF(to_return);
if (final_mod == NULL) {
if (!_PyErr_Occurred(tstate)) {
_PyErr_Format(tstate, PyExc_KeyError,
"%R not in sys.modules as expected",
to_return);
}
Py_DECREF(to_return);
goto error;
}
Py_DECREF(to_return);
}
}
else {