Possible NULL-pointer dereference in faulthandler_user
#96652
Comments
ovchinnikov-v-a
added
the
type-crash
kumaraditya303
added
type-bug
For systems without `sigaction` (i.e. HAVE_SIGACTION is undefined) `faulthandler_user` has to check previous signal handler to be defined (non-NULL) before calling it. Otherwise the code is subject to segmentation faults.
|
The bug can be reproduced simply with: import faulthandler
import signal
import time
faulthandler.register(signal.SIGALRM, chain=True)
signal.alarm(1)
time.sleep(2)
print("exit")The question is more what is your platform. It doesn't support sigaction()? |
|
PR #96666 should fix the issue. |
It's our customer's OS we're porting CPython to. |
Can you share the OS name? Or is it private? If yes, please mention the OS version. |
…ythonGH-96666) Fix the faulthandler implementation of faulthandler.register(signal, chain=True) if the sigaction() function is not available: don't call the previous signal handler if it's NULL. (cherry picked from commit c580a81) Co-authored-by: Victor Stinner <vstinner@python.org>
…ythonGH-96666) Fix the faulthandler implementation of faulthandler.register(signal, chain=True) if the sigaction() function is not available: don't call the previous signal handler if it's NULL. (cherry picked from commit c580a81) Co-authored-by: Victor Stinner <vstinner@python.org>
Fix the faulthandler implementation of faulthandler.register(signal, chain=True) if the sigaction() function is not available: don't call the previous signal handler if it's NULL.
It's covered by NDA so far, sorry. Might be disclosed later provided they decide to publicly share OS and this port in particular. |
Fix the faulthandler implementation of faulthandler.register(signal, chain=True) if the sigaction() function is not available: don't call the previous signal handler if it's NULL. (cherry picked from commit c580a81) Co-authored-by: Victor Stinner <vstinner@python.org>
Fix the faulthandler implementation of faulthandler.register(signal, chain=True) if the sigaction() function is not available: don't call the previous signal handler if it's NULL. (cherry picked from commit c580a81) Co-authored-by: Victor Stinner <vstinner@python.org>
Crash report
Segmentation fault occurs whenever
test_socketserversuite takes more than 60 seconds on a system withHAVE_SIGACTIONundefined.To reproduce the issue:
#define HAVE_SIGACTION 1with#undef HAVE_SIGACTIONinpyconfig.h.forloop intest_tcpserver_bind_leak(Lib/test/test_socketserver.py):CPythonwithmake.test_socketservertest suite withmake test TESTOPTS="-j1 -v test_socketserver".Once 60-seconds alarm set in
SocketServerTest::setUpgoes off,SIGALRMhandler (i.e.faulthandler_user) gets called, prints Python's traceback (viafaulthandler_dump_traceback) and crashes while callinguser->previousthat isNULL.Error messages
Your environment
CPython built from sources:
main dde15f5879 [origin/main] gh-94808: Improve coverage of _PyBytes_FormatEx (GH-95895)Operating system and architecture:
Linux 5.15.0-46-generic #49-Ubuntu SMP x86_64 x86_64 x86_64 GNU/LinuxThe text was updated successfully, but these errors were encountered: