Harden validation of remote debugging offset tables

_remote_debugging should perform stricter validation of externally read debug-offset metadata before using it to size memory reads or interpret remote process layouts. The current attach path verifies version compatibility, but it should also reject malformed or inconsistent offset and size tables up front, including optional asyncio metadata when it is loaded, so invalid data is handled cleanly rather than being consumed by the unwinder.

Linked PRs

My own claude also independently found this (very much a theme at the moment in time as all sorts of people are realizing what the tools they've got can do) so I had one variant of a PR waiting for this being a public issue. attached as a draft in case you find it useful.

@gpshead

My own claude also independently found this (very much a theme at the moment in time as all sorts of people are realizing what the tools they've got can do) so I had one variant of a PR waiting for this being a public issue. attached as a draft in case you find it useful.

Thanks a lot @gpshead! I answer in the PR but I am afraid the fix requires much more than just checking for the async debug as we need to validate all the offsets somehow and also ensure there aren't other vectors for the same thing :(

Add NEWS entry for pythongh-148178

yeah i figured this probably went beyond just that very targeted one...

Alright I will prepare a PR. At the very least we need to:

Validate all fields in the async debug and regular offsets fields.
Ensure that if someone adds a new field we fail at compile time if a validation is not added
Sanitize other vectors for the same problem.
Do this in a way that doesn't have runtime performance impact

pythongh-148178: Validate remote debug offset tables on load

Merge pull request #125 from maurycy/maurycy-memcpy-get-member

gh-148178: Validate remote debug offset tables on load (#148187)

This should be backported to 3.14, no?

Yes but the patch is non trivisl, it needs to be re-created

pythongh-148178: Validate remote debug offset tables on load (python#…

Update python315 to version 3.15.0~a8 / rev 12 via SR 1349644

Update python315 to version 3.15.0~a8 / rev 13 via SR 1349863

[3.14] gh-148178: Validate remote debug offset tables on load (GH-148187

Navigation Menu

Repository navigation

Harden validation of remote debugging offset tables #148178

Linked PRs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Harden validation of remote debugging offset tables #148178

Description

Linked PRs

Activity

gpshead commented on Apr 6, 2026

pablogsal commented on Apr 6, 2026

gpshead commented on Apr 6, 2026

pablogsal commented on Apr 6, 2026

StanFromIreland commented on Apr 14, 2026

pablogsal commented on Apr 14, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions