-
-
Notifications
You must be signed in to change notification settings - Fork 32.2k
gh-92810: Reduce memory usage by ABCMeta.__subclasscheck__ #131914
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Modules/_abc.c
Outdated
if (scls == NULL) { | ||
goto end; | ||
} | ||
int r = PyObject_IsSubclass(subclass, scls); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think we have a UAF here. PyObject_IsSubclass
can call __subclasscheck__
which can itseslf call arbitrary code so you might mutate subclasses
. The issue already exists with the existing code but can you confirm that we can indeed produce a UAF? (if you don't know how to do it, I'll try to investigate this separately tomorrow)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
can you confirm that we can indeed produce a UAF?
Sorry, my C knowledge is very minimal, I don't know anything about this yet
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
3 similar comments
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Signed-off-by: Martynov Maxim <[email protected]>
Signed-off-by: Martynov Maxim <[email protected]>
Signed-off-by: Martynov Maxim <[email protected]>
Signed-off-by: Martynov Maxim <[email protected]>
Signed-off-by: Martynov Maxim <[email protected]>
abf4bfe
to
b7603e0
Compare
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
I've added a simple recursion check to |
_abc._abc_subclasscheck
has very poor performance and (I think) a memory leak #92810test_performance_abc.py
For 8k nested subclasses:
isinstance(cached class, parent)
isinstance(cached class, sibling)
isinstance(cached class, grandparent)
isinstance(cached class, cousin)
isinstance(cached class, parent via .register())
isinstance(cached class, sibling via .register())
isinstance(cached class, grandparent via .register())
isinstance(cached class, cousin via .register())
isinstance(cached class, parent via __subclasses__)
isinstance(cached class, sibling via __subclasses__)
isinstance(cached class, grandparent via __subclasses__)
isinstance(cached class, cousin via __subclasses__)
isinstance(new class, parent)
isinstance(new class, sibling)
isinstance(new class, grandparent)
isinstance(new class, cousin)
isinstance(new class, parent via .register())
isinstance(new class, sibling via .register())
isinstance(new class, grandparent via .register())
isinstance(new class, cousin via .register())
isinstance(new class, parent via __subclasses__)
isinstance(new class, sibling via __subclasses__)
isinstance(new class, grandparent via __subclasses__)
isinstance(new class, cousin via __subclasses__)