Skip to content

gh-112564: Fix UAF for gc debug print #160662

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nascheme merged 10 commits into from
Nov 12, 2026
Merged

gh-112564: Fix UAF for gc debug print #160662

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
db87281
Fix UAF for gc debug print
johng Oct 25, 2026
e548578
Remove added test and comment debug_cycles loop
johng Oct 26, 2026
f65a2ff
Avoid recalculating gc_list_size in debug case
johng Oct 26, 2026
0a64683
Align debug_cycles with CPython style
johng Oct 26, 2026
8c485ea
Buffer debug cycles output before printing it via stderr
johng Oct 30, 2026
93e1bd1
move format string into a variable
johng Oct 30, 2026
2087232
Size debug_cycle lines from tp_name instead of measuring with snprintf
johng Oct 31, 2026
5771cc4
Include msg length when sizing debug_cycle lines
johng Oct 31, 2026
266e5ee
Print debug_cycle address with explicit 0x prefix for Windows
johng Oct 31, 2026
3f3860c
Update NEWS entry and debug_cycles comment per review
johng Nov 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions Misc/NEWS.d/next/Core_and_Builtins/2026-10-25-12-30-00.gh-issue-112564.gcDbgW.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
Fix a crash in the garbage collector when :data:`gc.DEBUG_COLLECTABLE` or
:data:`gc.DEBUG_UNCOLLECTABLE` is set and writing the debug output to
:data:`sys.stderr` frees one of the objects being reported. Object addresses
in this output now use the same ``0x``-prefixed lowercase format on all
platforms, including Windows.
66 changes: 53 additions & 13 deletions Python/gc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -996,11 +996,55 @@ clear_weakrefs(PyGC_Head *unreachable)
}
}

static void
/* "gc: " + " <" + " 0x" + 16 hex digits + ">\n" + NUL, excluding msg and
* tp_name */
#define DEBUG_LINE_FIXED_LEN 32

static char *
debug_cycle(const char *msg, PyObject *op)
{
PySys_FormatStderr("gc: %s <%s %p>\n",
msg, Py_TYPE(op)->tp_name, op);
const char *name = Py_TYPE(op)->tp_name;
size_t size = strlen(msg) + strlen(name) + DEBUG_LINE_FIXED_LEN;
char *line = PyMem_RawMalloc(size);
if (line == NULL) {
return NULL;
}
/* Not %p: its output is platform-specific (no "0x" prefix on Windows). */

@nascheme nascheme Nov 11, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You should mention in NEWS that formatting on some platforms like Windows has changed (lowercase, now always with 0x prefix). Likely no one should care but mention.

PyOS_snprintf(line, size, "gc: %s <%s 0x%" PRIxPTR ">\n",
msg, name, (uintptr_t)op);
return line;
}

/* Format a line for each object in `list` before printing any of them,
* since sys.stderr.write() can run Python code that frees objects in the
* list.
*/
static Py_ssize_t
debug_cycles(const char *msg, PyGC_Head *list)
{
Py_ssize_t n = gc_list_size(list);
if (n == 0) {
return n;
}

char **lines = PyMem_RawCalloc(n, sizeof(char *));
if (lines == NULL) {
return n;
}

Py_ssize_t i = 0;
for (PyGC_Head *gc = GC_NEXT(list); gc != list; gc = GC_NEXT(gc), i++) {
lines[i] = debug_cycle(msg, FROM_GC(gc));
}

for (i = 0; i < n; i++) {
if (lines[i] != NULL) {
PySys_FormatStderr("%s", lines[i]);
}
PyMem_RawFree(lines[i]);
}
PyMem_RawFree(lines);
return n;
}

/* Handle uncollectable garbage (cycles with tp_del slots, and stuff reachable
Expand Down Expand Up @@ -1435,7 +1479,6 @@ gc_collect_main(PyThreadState *tstate, int generation, _PyGC_Reason reason)
PyGC_Head *old; /* next older generation */
PyGC_Head unreachable; /* non-problematic unreachable trash */
PyGC_Head finalizers; /* objects with, & reachable from, __del__ */
PyGC_Head *gc;
GCState *gcstate = &tstate->interp->gc;

// gc_collect_main() must not be called before _PyGC_Init
Expand Down Expand Up @@ -1558,9 +1601,7 @@ gc_collect_main(PyThreadState *tstate, int generation, _PyGC_Reason reason)
if (gcstate->debug & _PyGC_DEBUG_COLLECTABLE) {
/* sys.stderr.write() can resurrect objects. */
needs_resurrection_check = true;
for (gc = GC_NEXT(&unreachable); gc != &unreachable; gc = GC_NEXT(gc)) {
debug_cycle("collectable", FROM_GC(gc));
}
debug_cycles("collectable", &unreachable);
}

/* Clear weakrefs and invoke callbacks as necessary. */
Expand Down Expand Up @@ -1603,13 +1644,12 @@ gc_collect_main(PyThreadState *tstate, int generation, _PyGC_Reason reason)

/* Collect statistics on uncollectable objects found and print
* debugging information. */
Py_ssize_t n = 0;
for (gc = GC_NEXT(&finalizers); gc != &finalizers; gc = GC_NEXT(gc)) {
n++;
if (gcstate->debug & _PyGC_DEBUG_UNCOLLECTABLE)
debug_cycle("uncollectable", FROM_GC(gc));
if (gcstate->debug & _PyGC_DEBUG_UNCOLLECTABLE) {
stats.uncollectable = debug_cycles("uncollectable", &finalizers);
}
else {
stats.uncollectable = gc_list_size(&finalizers);
}
stats.uncollectable = n;
(void)PyTime_PerfCounterRaw(&stats.ts_stop);
stats.duration = PyTime_AsSecondsDouble(stats.ts_stop - stats.ts_start);
if (gcstate->debug & _PyGC_DEBUG_STATS) {
Expand Down
Loading