File python-2.7.14-CVE-2018-1000030-1.patch of Package python-base.6853

Overview Repositories Revisions Requests Users Attributes Meta

File python-2.7.14-CVE-2018-1000030-1.patch of Package python-base.6853

From 6401e5671781eb217ee1afb4603cc0d1b0367ae6 Mon Sep 17 00:00:00 2001
From: Serhiy Storchaka <storchaka@gmail.com>
Date: Fri, 10 Nov 2017 12:58:55 +0200
Subject: [PATCH] [2.7] bpo-31530: Stop crashes when iterating over a file on
 multiple threads. (#3672)

---
 Lib/test/test_file2k.py                            | 32 ++++++++++++++++++++++
 .../2017-09-20-18-28-09.bpo-31530.CdLOM7.rst       |  4 +++
 Objects/fileobject.c                               | 19 +++++++++++--
 3 files changed, 52 insertions(+), 3 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Core and Builtins/2017-09-20-18-28-09.bpo-31530.CdLOM7.rst

Index: Python-2.7.13/Lib/test/test_file2k.py
===================================================================
--- Python-2.7.13.orig/Lib/test/test_file2k.py	2016-12-17 20:05:06.000000000 +0000
+++ Python-2.7.13/Lib/test/test_file2k.py	2018-03-13 17:23:47.337354038 +0000
@@ -652,6 +652,38 @@ class FileThreadingTests(unittest.TestCa
             self.f.writelines('')
         self._test_close_open_io(io_func)
 
+    def test_iteration_torture(self):
+        # bpo-31530: Crash when concurrently iterate over a file.
+        with open(self.filename, "wb") as fp:
+            for i in xrange(2**20):
+                fp.write(b"0"*50 + b"\n")
+        with open(self.filename, "rb") as f:
+            def iterate():
+                try:
+                    for l in f:
+                        pass
+                except IOError:
+                    pass
+            self._run_workers(iterate, 10)
+
+    def test_iteration_seek(self):
+        # bpo-31530: Crash when concurrently seek and iterate over a file.
+        with open(self.filename, "wb") as fp:
+            for i in xrange(10000):
+                fp.write(b"0"*50 + b"\n")
+        with open(self.filename, "rb") as f:
+            it = iter([1] + [0]*10)  # one thread reads, others seek
+            def iterate():
+                try:
+                    if next(it):
+                        for l in f:
+                            pass
+                    else:
+                        for i in range(100):
+                            f.seek(i*100, 0)
+                except IOError:
+                    pass
+            self._run_workers(iterate, 10)
 
 @unittest.skipUnless(os.name == 'posix', 'test requires a posix system.')
 class TestFileSignalEINTR(unittest.TestCase):
Index: Python-2.7.13/Misc/NEWS.d/next/Core and Builtins/2017-09-20-18-28-09.bpo-31530.CdLOM7.rst
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ Python-2.7.13/Misc/NEWS.d/next/Core and Builtins/2017-09-20-18-28-09.bpo-31530.CdLOM7.rst	2018-03-13 17:23:47.337354038 +0000
@@ -0,0 +1,4 @@
+Fixed crashes when iterating over a file on multiple threads.
+seek() and next() methods of file objects now raise an exception during
+concurrent operation on the same file object.
+A lock can be used to prevent the error.
Index: Python-2.7.13/Objects/fileobject.c
===================================================================
--- Python-2.7.13.orig/Objects/fileobject.c	2016-12-17 20:05:07.000000000 +0000
+++ Python-2.7.13/Objects/fileobject.c	2018-03-13 17:23:47.337354038 +0000
@@ -430,7 +430,7 @@ close_the_file(PyFileObject *f)
             if (f->ob_refcnt > 0) {
                 PyErr_SetString(PyExc_IOError,
                     "close() called during concurrent "
-                    "operation on the same file object.");
+                    "operation on the same file object");
             } else {
                 /* This should not happen unless someone is
                  * carelessly playing with the PyFileObject
@@ -438,7 +438,7 @@ close_the_file(PyFileObject *f)
                  * pointer. */
                 PyErr_SetString(PyExc_SystemError,
                     "PyFileObject locking error in "
-                    "destructor (refcnt <= 0 at close).");
+                    "destructor (refcnt <= 0 at close)");
             }
             return NULL;
         }
@@ -762,6 +762,12 @@ file_seek(PyFileObject *f, PyObject *arg
 
     if (f->f_fp == NULL)
         return err_closed();
+    if (f->unlocked_count > 0) {
+        PyErr_SetString(PyExc_IOError,
+            "seek() called during concurrent "
+            "operation on the same file object");
+        return NULL;
+    }
     drop_readahead(f);
     whence = 0;
     if (!PyArg_ParseTuple(args, "O|i:seek", &offobj, &whence))
@@ -2238,6 +2244,7 @@ readahead(PyFileObject *f, Py_ssize_t bu
 {
     Py_ssize_t chunksize;
 
+    assert(f->unlocked_count == 0);
     if (f->f_buf != NULL) {
         if( (f->f_bufend - f->f_bufptr) >= 1)
             return 0;
@@ -2279,6 +2286,12 @@ readahead_get_line_skip(PyFileObject *f,
     char *buf;
     Py_ssize_t len;
 
+    if (f->unlocked_count > 0) {
+        PyErr_SetString(PyExc_IOError,
+            "next() called during concurrent "
+            "operation on the same file object");
+        return NULL;
+    }
     if (f->f_buf == NULL)
         if (readahead(f, bufsize) < 0)
             return NULL;
@@ -2692,7 +2705,7 @@ int PyObject_AsFileDescriptor(PyObject *
     }
     else {
         PyErr_SetString(PyExc_TypeError,
-                        "argument must be an int, or have a fileno() method.");
+                        "argument must be an int, or have a fileno() method");
         return -1;
     }

Places

File python-2.7.14-CVE-2018-1000030-1.patch of Package python-base.6853

Places