Skip to content

gh-143004: Fix UAF in _collections Counter update fast path #143044

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
serhiy-storchaka merged 8 commits into from
Dec 25, 2025
+20 −0
Merged

gh-143004: Fix UAF in _collections Counter update fast path #143044

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
ce88c7e
Fix UAF in _collections Counter update fast path
Kaushalt2004 Dec 21, 2025
e0036f1
Merge branch 'main' into #1
Kaushalt2004 Dec 22, 2025
9ed24b4
gh-143004: Add Counter UAF NEWS entry and benchmark script
Kaushalt2004 Dec 22, 2025
ae5cb7e
fixed after review
Kaushalt2004 Dec 22, 2025
7712af2
Update Misc/NEWS.d/next/Library/2025-12-22-00-00-00.gh-issue-143004.u…
Kaushalt2004 Dec 23, 2025
93a6546
Update Misc/NEWS.d/next/Library/2025-12-22-00-00-00.gh-issue-143004.u…
Kaushalt2004 Dec 23, 2025
49cff07
Simplify Evil class in re-entrant Counter test: remove unnecessary __…
Kaushalt2004 Dec 25, 2025
81d4672
Apply suggestion from @serhiy-storchaka
skirpichev Dec 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions Lib/test/test_collections.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2135,6 +2135,19 @@ def test_basics(self):
self.assertEqual(c.setdefault('e', 5), 5)
self.assertEqual(c['e'], 5)

def test_update_reentrant_add_clears_counter(self):
c = Counter()
key = object()

class Evil(int):
def __add__(self, other):
c.clear()
return NotImplemented

c[key] = Evil()
c.update([key])
self.assertEqual(c[key], 1)

def test_init(self):
self.assertEqual(list(Counter(self=42).items()), [('self', 42)])
self.assertEqual(list(Counter(iterable=42).items()), [('iterable', 42)])
Expand Down
2 changes: 2 additions & 0 deletions Misc/NEWS.d/next/Library/2025-12-22-00-00-00.gh-issue-143004.uaf-counter.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
Fix a potential use-after-free in :meth:`collections.Counter.update` when user code
mutates the Counter during an update.
5 changes: 5 additions & 0 deletions Modules/_collectionsmodule.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2577,7 +2577,12 @@ _collections__count_elements_impl(PyObject *module, PyObject *mapping,
if (_PyDict_SetItem_KnownHash(mapping, key, one, hash) < 0)
goto done;
} else {
/* oldval is a borrowed reference. Keep it alive across
PyNumber_Add(), which can execute arbitrary user code and
mutate (or even clear) the underlying dict. */
Py_INCREF(oldval);
newval = PyNumber_Add(oldval, one);
Py_DECREF(oldval);
if (newval == NULL)
goto done;
if (_PyDict_SetItem_KnownHash(mapping, key, newval, hash) < 0)
Expand Down
Loading