gh-142884: Fix UAF in array.array.tofile with concurrent mutations
#142920
+14,928
−4,195
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The bytecode panel appears when a user generates a heatmap with --opcodes and clicks the button to unfold a line and display the bytecode instructions. Currently, an empty space appears on the left where the line number, self, and total columns are displayed. This area should instead extend those columns, rather than leaving a gap.
…e no longer available (python#137064)
…rotocol prefix in OpenerDirector (pythonGH-136873)
…sion` in `xml.sax.expatreader` & `xml.sax.handler` (python#142898)
* Invalidating an executor does not cause arbitrary code to run * Executors are only freed at safe points
…ons and `_PyDict_NotifyEvent` (python#142923)
Now that we specialize range iteration in the interpreter for the common case where the iterator has only one reference, there's not a significant performance cost to making the iteration thread-safe.
Co-authored-by: Stan Ulbrych <[email protected]>
…orting buffer in bytearray (python#142938)
…f an integer input (python#142483) If *a* is an integer, the sign of *a* is discarded in the C source code. Clarify this behavior to prevent foot guns, where a common use case might naively assume that flipping the sign will produce different sequences (e.g. for a train/test split of a synthetic data generator in machine learning). Co-authored-by: Adam Turner <[email protected]>
…e tutorial (pythonGH-142314) Co-authored-by: Stan Ulbrych <[email protected]> Co-authored-by: Éric <[email protected]> Co-authored-by: Daniele Nicolodi <[email protected]> Co-authored-by: Peter Bierma <[email protected]>
…pythonGH-142921) JIT: Borrow references for immortal promoted globals
…ythongh-142599) This makes generator frame state transitions atomic in the free threading build, which avoids segfaults when trying to execute a generator from multiple threads concurrently. There are still a few operations that aren't thread-safe and may crash if performed concurrently on the same generator/coroutine: * Accessing gi_yieldfrom/cr_await/ag_await * Accessing gi_frame/cr_frame/ag_frame * Async generator operations
…142995) TSan treats compare-exchanges that fail as if they are writes so there is a false positive with the read of gi_frame_state in gen_close.
…-142957) The use of memmove and _Py_memory_repeat were not thread-safe in the free threading build in some cases. In theory, memmove and _Py_memory_repeat can copy byte-by-byte instead of pointer-by-pointer, so concurrent readers could see uninitialized data or tearing. Additionally, we should be using "release" (or stronger) ordering to be compliant with the C11 memory model when copying objects within a list.
tomasr8
removed request for
1st1,
AA-Turner,
FFY00,
Fidget-Spinner,
ZeroIntensity,
abalkin,
asvetlov,
brandtbucher,
corona10,
diegorusso,
emmatyping,
ericsnowcurrently,
erlend-aasland,
ethanfurman,
ezio-melotti,
gaogaotiantian,
hugovk,
jaraco,
kumaraditya303,
lysnikolaou,
markshannon,
methane,
ncoghlan,
pablogsal,
pganssle,
rhettinger,
savannahostrowski,
tomasr8,
warsaw and
willingc
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
the original code precomputed nblocks at the beginning of the function, but when a reentrant
writer cleared the array during the first callback, self->ob_item became NULL. The loop continued iterating based on the cached values and dereferenced the null pointer.
array.array.tofilevia reentrant writer #142884