Repository navigation
hashlib segmentation fault #79103
Description
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = None
closed_at = <Date 2020-01-14.22:56:24.735>
created_at = <Date 2018-10-07.12:40:29.942>
labels = ['extension-modules', '3.7', '3.8', 'type-crash']
title = 'hashlib segmentation fault'
updated_at = <Date 2020-01-14.22:56:24.734>
user = 'https://github.com/httpsgithubcomxcainiao'bugs.python.org fields:
activity = <Date 2020-01-14.22:56:24.734>
actor = 'ned.deily'
assignee = 'none'
closed = True
closed_date = <Date 2020-01-14.22:56:24.735>
closer = 'ned.deily'
components = ['Extension Modules']
creation = <Date 2018-10-07.12:40:29.942>
creator = 'shuoz'
dependencies = []
files = []
hgrepos = []
issue_num = 34922
keywords = ['patch']
message_count = 16.0
messages = ['327277', '327283', '327285', '327288', '327294', '327306', '327312', '327495', '327515', '327518', '327519', '327604', '327606', '327619', '327677', '360009']
nosy_count = 7.0
nosy_names = ['terry.reedy', 'vstinner', 'christian.heimes', 'ned.deily', 'serhiy.storchaka', 'xtreak', 'shuoz']
pr_nums = ['9751', '9797', '9798', '9801']
priority = None
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue34922'
versions = ['Python 3.6', 'Python 3.7', 'Python 3.8']
Activity
httpsgithubcomxcainiao commentedon Oct 7, 2018
python hashlib a signd overflow maybe cause a memory over read.
python version:
Python 3.6.7rc1+ (heads/3.6:cb0bec3, Oct 1 2018, 02:19:39)
[GCC 7.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
x.py
ned-deily commentedon Oct 7, 2018
See also bpo-33729. We need this addressed for 3.6.7.
tirkarthi commentedon Oct 7, 2018
Thanks for the report. Interesting, this is not reproducible on master and latest 3.7 branches though both have different errors but reproducible in latest 3.6 and v3.7.0 . As Ned noted this seems to have been fixed with bpo-33729 but still there is no decision on reverting/keeping the commits made with the linked issue.
# master
# upstream/3.7
# 3.7.0 segfaults
# upstream/3.6 segfaults
Thanks
tirkarthi commentedon Oct 7, 2018
Sorry Ned, my comment seems to have changed the priority while submitting the comment. I would also propose adding the attached report as a unit test.
ned-deily commentedon Oct 7, 2018
No problem; that's something to watch out for when you get an update conflict message from the bug tracker! Regarding this issue, I believe Serhiy is going to do a PR but perhaps you can work with him on providing the test case.
2 remaining items
ned-deily commentedon Oct 10, 2018
We've reached the cutoff point for 3.7.1rc2 and 3.6.7rc2 and I don't see a PR or a resolution of this for either branch yet. If there's a chance for merged PRs in the next couple of hours, I'll wait a bit longer but otherwise these fixes will have to wait.
serhiy-storchaka commentedon Oct 11, 2018
New changeset 9b8c2e7 by Serhiy Storchaka in branch 'master':
bpo-34922: Fix integer overflow in the digest() and hexdigest() methods (GH-9751)
9b8c2e7
serhiy-storchaka commentedon Oct 11, 2018
New changeset 8b040e5 by Serhiy Storchaka in branch '3.7':
[3.7] bpo-34922: Fix integer overflow in the digest() and hexdigest() methods (GH-9751) (GH-9798)
8b040e5
serhiy-storchaka commentedon Oct 11, 2018
New changeset 69e6ad6 by Serhiy Storchaka (Miss Islington (bot)) in branch '3.6':
[3.6] bpo-34922: Fix integer overflow in the digest() and hexdigest() methods (GH-9751) (GH-9798) (GH-9801)
69e6ad6
terryjreedy commentedon Oct 12, 2018
Should this be closed as fixed?
serhiy-storchaka commentedon Oct 12, 2018
Since it is tagged as a release blocker, I think that only Ned can close it.
Personally I don't think that this issue is a security issue. digest() and hexdigest() argument usually is a constant. It is unlikely that the crash can be triggered by user data.
httpsgithubcomxcainiao commentedon Oct 13, 2018
oh brother, maybe this worth open a cve.
ned-deily commentedon Oct 13, 2018
Serhiy's fixes (thanks!) are now released in 3.7.0rc2 and 3.6.7rc2 so I'm removing the "release blocker" status. If there is nothing more to be done for this issue, can we close it?
shuoz:
Note that Serhiy believes that this is not a security issue since it is unlikely that the crash can be triggered by user data. Anyone can cause segfaults or do damage if they have unrestricted access to a Python interpreter; that's a threat model for any language that allows sometime like Python's os.system or subprocess. A better question is can a user of an application written in Python likely cause a DOS or create a privilege escalation. Is that the case here?
ned-deily commentedon Jan 14, 2020
Since there has been no further discussion on this since the fixes were pushed over a year ago, I am declaring this issue resolved. Thanks for everyone's help!