Repository navigation
asyncio: Possible missing typecheck in overlapped.c #98793
Description
I don't have a Windows machine to check, but I noticed while reading code that the _overlapped.WSAConnect() function calls PyTuple_GET_SIZE on its argument without checking that it is actually a tuple (
Line 1358 in 3e07f82
The following code should reproduce the problem and access out-of-bounds memory:
import asyncio.windows_events
import socket
ip = asyncio.windows_events.IocpProactor()
sock = socket.socket(type=socket.SOCK_DGRAM)
ip.connect(sock, None)
Activity
serhiy-storchaka commentedon Oct 28, 2022
It is checked in
_overlapped.Overlapped.ConnectEx, but not in_overlapped.WSAConnectand_overlapped.Overlapped.WSASendTo.Fidget-Spinner commentedon Oct 28, 2022
I can confirm on Windows debug build that this gives me:
Assertion failed: PyTuple_Check(op), file D:\Ken\Documents\GitHub\cpython\Include\cpython\tupleobject.h, line 23So there needs to be a type check somewhere.
serhiy-storchaka commentedon Oct 28, 2022
I have marked it as "easy" because the fix is trivial -- just use corresponding Argument Clinic declaration in other methods as in
_overlapped.Overlapped.ConnectEx. The nontrivial part is writing tests for both of affected functions. It needs an access to Windows and some time, so I left it to other contributors.LUCIOUS999 commentedon Oct 28, 2022
CharlieZhao95 commentedon Oct 29, 2022
I'm trying to create a PR for this issue and it won't take long :)
gh-98793: Fix typecheck in `overlapped.c` (#98835)
pythongh-98793: Fix typecheck in `overlapped.c` (python#98835)
pythongh-98793: Fix typecheck in `overlapped.c` (python#98835)
[3.11] gh-98793: Fix typecheck in `overlapped.c` (GH-98835) (#98889)
[3.10] gh-98793: Fix typecheck in `overlapped.c` (GH-98835) (#98890)
hauntsaninja commentedon Nov 6, 2022
Thanks, looks like this has been completed!
[3.9] pythongh-98793: Fix typecheck in `overlapped.c` (pythonGH-98835) (
[3.9] gh-98793: Fix typecheck in `overlapped.c` (GH-98835) (GH-98890) (…