• Angus Gratton's avatar
    py/objarray: Fix use-after-free if extending a bytearray from itself. · 4bed614e
    Angus Gratton authored
    Two cases, one assigning to a slice.
    Closes https://github.com/micropython/micropython/issues/13283
    
    Second is extending a slice from itself, similar logic.
    
    In both cases the problem occurs when m_renew causes realloc to move the
    buffer, leaving a dangling pointer behind.
    
    There are more complex and hard to fix cases when either argument is a
    memoryview into the buffer, currently resizing to a new address breaks
    memoryviews into that object.
    
    Reproducing this bug and confirming the fix was done by running the unix
    port under valgrind with GC-aware extensions.
    
    Note in default configurations with GIL this bug exists but has no impact
    (the free buffer won't be reused while the function is still executing, and
    is no longer referenced after it returns).
    Signed-off-by: default avatarAngus Gratton <angus@redyak.com.au>
    4bed614e
objarray.c 27.8 KB