Skip to content

Conversation

@yihong0618
Copy link
Contributor

@yihong0618 yihong0618 commented Dec 21, 2025

this patch fix crash .TextIOWrapper.seek with a custom int method detaches

add textiowrapper_parse_cookie instead of check detect again to make the code clear

@yihong0618 yihong0618 changed the title fix: crash .TextIOWrapper.seek with a custom __int__ method detaches gh-143007: fix crash .TextIOWrapper.seek with a custom __int__ method detaches Dec 21, 2025

// gh-143007: PyNumber_Long can call arbitrary code through __int__
// which may detach the underlying buffer.
if (self->detached) {
Copy link
Contributor

@cmaloney cmaloney Dec 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this isn't the right place to add the check, the _PyFile_Flush just before this could result in the same issue, and the cookie's buffer / decoding into it isn't what actually breaks (the buffer in this function is locally allocated, the cookie should be valid the whole time of this function).

I think this should do a CHECK_ATTACHED like check just before the res = PyObject_CallMethodOneArg(self->buffer, &_Py_ID(seek), posobj); as that's what is doing the self->buffer usage/call/dereference.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes but it is my first solution
an rethink that we can forget add in the future in other place

CHECK_ATTACHED and check it in the middle of the code is not match its name

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants