File python-2.7.14-CVE-2018-1000030-1.patch of Package python.11987
From 6401e5671781eb217ee1afb4603cc0d1b0367ae6 Mon Sep 17 00:00:00 2001
From: Serhiy Storchaka <storchaka@gmail.com>
Date: Fri, 10 Nov 2017 12:58:55 +0200
Subject: [PATCH] [2.7] bpo-31530: Stop crashes when iterating over a file on
multiple threads. (#3672)
---
Lib/test/test_file2k.py | 32 ++++++++++++++++++++++
.../2017-09-20-18-28-09.bpo-31530.CdLOM7.rst | 4 +++
Objects/fileobject.c | 19 +++++++++++--
3 files changed, 52 insertions(+), 3 deletions(-)
create mode 100644 Misc/NEWS.d/next/Core and Builtins/2017-09-20-18-28-09.bpo-31530.CdLOM7.rst
Index: Python-2.7.13/Lib/test/test_file2k.py
===================================================================
--- Python-2.7.13.orig/Lib/test/test_file2k.py 2016-12-17 20:05:06.000000000 +0000
+++ Python-2.7.13/Lib/test/test_file2k.py 2018-03-13 17:23:47.337354038 +0000
@@ -652,6 +652,38 @@ class FileThreadingTests(unittest.TestCa
self.f.writelines('')
self._test_close_open_io(io_func)
+ def test_iteration_torture(self):
+ # bpo-31530: Crash when concurrently iterate over a file.
+ with open(self.filename, "wb") as fp:
+ for i in xrange(2**20):
+ fp.write(b"0"*50 + b"\n")
+ with open(self.filename, "rb") as f:
+ def iterate():
+ try:
+ for l in f:
+ pass
+ except IOError:
+ pass
+ self._run_workers(iterate, 10)
+
+ def test_iteration_seek(self):
+ # bpo-31530: Crash when concurrently seek and iterate over a file.
+ with open(self.filename, "wb") as fp:
+ for i in xrange(10000):
+ fp.write(b"0"*50 + b"\n")
+ with open(self.filename, "rb") as f:
+ it = iter([1] + [0]*10) # one thread reads, others seek
+ def iterate():
+ try:
+ if next(it):
+ for l in f:
+ pass
+ else:
+ for i in range(100):
+ f.seek(i*100, 0)
+ except IOError:
+ pass
+ self._run_workers(iterate, 10)
@unittest.skipUnless(os.name == 'posix', 'test requires a posix system.')
class TestFileSignalEINTR(unittest.TestCase):
Index: Python-2.7.13/Misc/NEWS.d/next/Core and Builtins/2017-09-20-18-28-09.bpo-31530.CdLOM7.rst
===================================================================
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
+++ Python-2.7.13/Misc/NEWS.d/next/Core and Builtins/2017-09-20-18-28-09.bpo-31530.CdLOM7.rst 2018-03-13 17:23:47.337354038 +0000
@@ -0,0 +1,4 @@
+Fixed crashes when iterating over a file on multiple threads.
+seek() and next() methods of file objects now raise an exception during
+concurrent operation on the same file object.
+A lock can be used to prevent the error.
Index: Python-2.7.13/Objects/fileobject.c
===================================================================
--- Python-2.7.13.orig/Objects/fileobject.c 2016-12-17 20:05:07.000000000 +0000
+++ Python-2.7.13/Objects/fileobject.c 2018-03-13 17:23:47.337354038 +0000
@@ -430,7 +430,7 @@ close_the_file(PyFileObject *f)
if (f->ob_refcnt > 0) {
PyErr_SetString(PyExc_IOError,
"close() called during concurrent "
- "operation on the same file object.");
+ "operation on the same file object");
} else {
/* This should not happen unless someone is
* carelessly playing with the PyFileObject
@@ -438,7 +438,7 @@ close_the_file(PyFileObject *f)
* pointer. */
PyErr_SetString(PyExc_SystemError,
"PyFileObject locking error in "
- "destructor (refcnt <= 0 at close).");
+ "destructor (refcnt <= 0 at close)");
}
return NULL;
}
@@ -762,6 +762,12 @@ file_seek(PyFileObject *f, PyObject *arg
if (f->f_fp == NULL)
return err_closed();
+ if (f->unlocked_count > 0) {
+ PyErr_SetString(PyExc_IOError,
+ "seek() called during concurrent "
+ "operation on the same file object");
+ return NULL;
+ }
drop_readahead(f);
whence = 0;
if (!PyArg_ParseTuple(args, "O|i:seek", &offobj, &whence))
@@ -2238,6 +2244,7 @@ readahead(PyFileObject *f, Py_ssize_t bu
{
Py_ssize_t chunksize;
+ assert(f->unlocked_count == 0);
if (f->f_buf != NULL) {
if( (f->f_bufend - f->f_bufptr) >= 1)
return 0;
@@ -2279,6 +2286,12 @@ readahead_get_line_skip(PyFileObject *f,
char *buf;
Py_ssize_t len;
+ if (f->unlocked_count > 0) {
+ PyErr_SetString(PyExc_IOError,
+ "next() called during concurrent "
+ "operation on the same file object");
+ return NULL;
+ }
if (f->f_buf == NULL)
if (readahead(f, bufsize) < 0)
return NULL;
@@ -2692,7 +2705,7 @@ int PyObject_AsFileDescriptor(PyObject *
}
else {
PyErr_SetString(PyExc_TypeError,
- "argument must be an int, or have a fileno() method.");
+ "argument must be an int, or have a fileno() method");
return -1;
}
