Skip to content

GH-125789: fix fut._callbacks to always return a copy of callbacks #125922

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Oct 25, 2024
Merged

GH-125789: fix fut._callbacks to always return a copy of callbacks #125922

merged 2 commits into from
Oct 25, 2024

Conversation

kumaraditya303
Copy link
Contributor

@kumaraditya303 kumaraditya303 commented Oct 24, 2024 •
edited by bedevere-app bot
Loading

@bedevere-app bedevere-app bot mentioned this pull request Oct 24, 2024
Closed
@kumaraditya303 kumaraditya303 mentioned this pull request Oct 24, 2024
Closed
@kumaraditya303 kumaraditya303 marked this pull request as ready for review October 24, 2024 14:12
@kumaraditya303
Copy link
Contributor Author 

== Tests result: SUCCESS ==

1 test skipped:
    test_asyncio.test_unix_events

30 tests OK.

Total duration: 6 min 8 sec
Total tests: run=2,242 skipped=74
Total test files: run=31/31 skipped=1
Result: SUCCESS

Refleak tested

@kumaraditya303 kumaraditya303 added topic-asyncio 3.12 only security fixes 3.13 bugs and security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes and removed 3.12 only security fixes 3.13 bugs and security fixes labels Oct 24, 2024
picnixz
picnixz reviewed Oct 25, 2024
View reviewed changes
Copy link
Member

@picnixz picnixz left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would add a test for that (e.g., one of the test that Nico wrote with the evil classes) to see that the interpreter does not crash anymore.

EDIT: My previous comment was wrong. We can still change the length by just adding new callbacks but we cannot change the type of the items.

@picnixz picnixz mentioned this pull request Oct 25, 2024
Closed
@kumaraditya303
Copy link
Contributor Author

I would add a test for that (e.g., one of the test that Nico wrote with the evil classes) to see that the interpreter does not crash anymore.

I think it is more appropriate to add that to your PR which fixes the UAF issues.

@kumaraditya303 kumaraditya303 merged commit cae853e into python:main Oct 25, 2024
38 checks passed
@miss-islington-app
Copy link

Thanks @kumaraditya303 for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12, 3.13.
🐍🍒⛏🤖

@kumaraditya303 kumaraditya303 deleted the callbacks branch October 25, 2024 12:49
@miss-islington-app
Copy link

Sorry, @kumaraditya303, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker cae853e3b44cd5cb033b904e163c490dd28bc30a 3.13

@miss-islington-app
Copy link

Sorry, @kumaraditya303, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker cae853e3b44cd5cb033b904e163c490dd28bc30a 3.12

@bedevere-app
Copy link

bedevere-app bot commented Oct 25, 2024

GH-125976 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Oct 25, 2024
kumaraditya303 added a commit to kumaraditya303/cpython that referenced this pull request Oct 25, 2024
@kumaraditya303
pythonGH-125789: fix fut._callbacks to always return a copy of call…
250ece9 
…backs (python#125922)

Fix `asyncio.Future._callbacks` to always return a copy of the internal list of callbacks to avoid mutation from user code affecting the internal state.

(cherry picked from commit cae853e)
kumaraditya303 added a commit that referenced this pull request Oct 25, 2024
@kumaraditya303
[3.13] GH-125789: fix fut._callbacks to always return a copy of cal…
f54e1a2 
…lbacks (#125922) (#125976)

GH-125789: fix `fut._callbacks` to always return a copy of callbacks (#125922)

Fix `asyncio.Future._callbacks` to always return a copy of the internal list of callbacks to avoid mutation from user code affecting the internal state.

(cherry picked from commit cae853e)
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 25, 2024
@kumaraditya303 @miss-islington
[3.13] pythonGH-125789: fix fut._callbacks to always return a copy …
374dc09 
…of callbacks (pythonGH-125922) (pythonGH-125976)

pythonGH-125789: fix `fut._callbacks` to always return a copy of callbacks (pythonGH-125922)

Fix `asyncio.Future._callbacks` to always return a copy of the internal list of callbacks to avoid mutation from user code affecting the internal state.

(cherry picked from commit f54e1a2)

Co-authored-by: Kumar Aditya <[email protected]>
(cherry picked from commit cae853e)
@miss-islington miss-islington mentioned this pull request Oct 25, 2024
Merged
kumaraditya303 added a commit that referenced this pull request Oct 25, 2024
@miss-islington @kumaraditya303
[3.12] GH-125789: fix fut._callbacks to always return a copy of cal…
42927f7 
…lbacks (GH-125922) (#125977)

GH-125789: fix `fut._callbacks` to always return a copy of callbacks (GH-125922)

Fix `asyncio.Future._callbacks` to always return a copy of the internal list of callbacks to avoid mutation from user code affecting the internal state.

Co-authored-by: Kumar Aditya <[email protected]>
(cherry picked from commit cae853e)
ebonnal pushed a commit to ebonnal/cpython that referenced this pull request Jan 12, 2025
@kumaraditya303 @ebonnal
pythonGH-125789: fix fut._callbacks to always return a copy of call…
a30843f 
…backs (python#125922)

Fix `asyncio.Future._callbacks` to always return a copy of the internal list of callbacks to avoid mutation from user code affecting the internal state.
@hugovk hugovk removed the needs backport to 3.12 only security fixes label Feb 26, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@picnixz picnixz picnixz left review comments

@1st1 1st1 Awaiting requested review from 1st1 1st1 is a code owner

@asvetlov asvetlov Awaiting requested review from asvetlov asvetlov is a code owner

@gvanrossum gvanrossum Awaiting requested review from gvanrossum

@willingc willingc Awaiting requested review from willingc willingc is a code owner

Assignees

@kumaraditya303 kumaraditya303

Labels
topic-asyncio
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@kumaraditya303 @picnixz @hugovk