Skip to content

[3.15] gh-157364: Fix use-after-free in io.TextIOWrapper during reentrant detach - #159591

Merged
vstinner merged 3 commits into
python:3.15from
vstinner:textio15
Oct 16, 2026
Merged

vstinner merged 3 commits into
python:3.15from
vstinner:textio15

Conversation

@vstinner

@vstinner vstinner commented Oct 16, 2026 •

Copy link
Copy Markdown
Member

cmaloney and others added 3 commits October 17, 2026 00:30
…lying stream access (python#145957)

TextIOWrapper keeps its underlying stream in a member called
`self->buffer`. That stream can be detached by user code, such as custom
`.flush` implementations resulting in `self->buffer` being set to NULL.
The implementation often checked at the start of functions if
`self->buffer` is in a good state, but did not always recheck after
other Python code was called which could modify `self->buffer`.

The cases which need to be re-checked are hard to spot so rather than
rely on reviewer effort create better safety by making all self->buffer
access go through helper functions.

Thank you yihong0618 for the test, NEWS and initial implementation in
pythongh-143041.

Co-authored-by: yihong0618 <zouzou0208@gmail.com>
Co-authored-by: Victor Stinner <vstinner@python.org>
(cherry picked from commit db4b194)
…ant detach (python#157370)

Co-authored-by: Victor Stinner <vstinner@python.org>
(cherry picked from commit e19dc47)
@vstinner vstinner added the needs backport to 3.14 bugs and security fixes label Oct 16, 2026
@vstinner
vstinner merged commit ea1312b into python:3.15 Oct 16, 2026
58 checks passed
@vstinner
vstinner deleted the textio15 branch October 16, 2026 23:23
@miss-islington-app

Copy link
Copy Markdown

Thanks @vstinner for the PR 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

@miss-islington-app

Copy link
Copy Markdown

Sorry, @vstinner, I could not cleanly backport this to 3.14 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker ea1312bdb446a536964ec7133625ae6aa6a592bf 3.14

@vstinner vstinner removed the needs backport to 3.14 bugs and security fixes label Oct 16, 2026
vstinner added a commit that referenced this pull request Oct 16, 2026
…rant detach (#159600)

[3.15] gh-157364: Fix use-after-free in io.TextIOWrapper during reentrant detach (#159591)

* gh-143008: Fix Null pointer dereferences in TextIOWrapper underlying stream access (#145957)

TextIOWrapper keeps its underlying stream in a member called
`self->buffer`. That stream can be detached by user code, such as custom
`.flush` implementations resulting in `self->buffer` being set to NULL.
The implementation often checked at the start of functions if
`self->buffer` is in a good state, but did not always recheck after
other Python code was called which could modify `self->buffer`.

The cases which need to be re-checked are hard to spot so rather than
rely on reviewer effort create better safety by making all self->buffer
access go through helper functions.

Thank you yihong0618 for the test, NEWS and initial implementation in
gh-143041.



(cherry picked from commit db4b194)

* gh-154523: Fix data-race in `TextIOWrapper.detach()` (#154565)

(cherry picked from commit 8440a6a)

* gh-157364: Fix use-after-free in io.TextIOWrapper during reentrant detach (#157370)


(cherry picked from commit e19dc47)

---------





(cherry picked from commit ea1312b)

Co-authored-by: Cody Maloney <cmaloney@users.noreply.github.com>
Co-authored-by: yihong0618 <zouzou0208@gmail.com>
Co-authored-by: Brij Kapadia <97006829+brijkapadia@users.noreply.github.com>
Co-authored-by: Shamil <ashm.tech@proton.me>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants