gh-143236: fix _PyEval_LoadName has use-after-free issue

[fatelei]

fix _PyEval_LoadName has use-after-free issue

• Issue: Use-after-free in _PyEval_LoadName via re-entrant frame locals lookup #143236

[yihong0618]

This change seems not fix the issue.

diff --git a/Python/ceval.c b/Python/ceval.c
index 924afaa974..14c9ba9ad0 100644
--- a/Python/ceval.c
+++ b/Python/ceval.c
@@ -4061,9 +4061,15 @@ _PyEval_LoadName(PyThreadState *tstate, _PyInterpreterFrame *frame, PyObject *na
                             "no locals found");
         return NULL;
     }
-    if (PyMapping_GetOptionalItem(frame->f_locals, name, &value) < 0) {
+    PyObject *locals = frame->f_locals;
+    Py_INCREF(locals);
+
+    if (PyMapping_GetOptionalItem(locals, name, &value) < 0) {
+        Py_DECREF(locals);
         return NULL;
     }
+
+    Py_DECREF(locals);
     if (value != NULL) {
         return value;
     }

[hyi@rocky cpython]$ ./python ttt.py 
=================================================================
==24620==ERROR: AddressSanitizer: heap-use-after-free on address 0xffffb3a0b4b0 at pc 0x0000005ec568 bp 0xffffc7bb72e0 sp 0xffffc7bb72d0
READ of size 8 at 0xffffb3a0b4b0 thread T0
    #0 0x5ec564 in compare_generic Objects/dictobject.c:1114
    #1 0x5ec564 in do_lookup Objects/dictobject.c:1009
    #2 0x5ec564 in dictkeys_generic_lookup Objects/dictobject.c:1128
    #3 0x5ec564 in _Py_dict_lookup Objects/dictobject.c:1294
    #4 0x5f4500 in _PyDict_GetItemRef_KnownHash Objects/dictobject.c:2425
    #5 0x5f4500 in PyDict_GetItemRef Objects/dictobject.c:2460
    #6 0x59d0b4 in framelocalsproxy_getitem Objects/frameobject.c:207
    #7 0x4fc67c in PyObject_GetItem Objects/abstract.c:163
    #8 0x4fc67c in PyMapping_GetOptionalItem Objects/abstract.c:215
    #9 0x81c358 in _PyEval_LoadName Python/ceval.c:4067
    #10 0x432558 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:8966
    #11 0x81d354 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:119
    #12 0x81d354 in _PyEval_Vector Python/ceval.c:2542
    #13 0x81d354 in PyEval_EvalCode Python/ceval.c:1008

[picnixz]

Closing since the fix is not straightforward. Please wait until we find a way to correctly fix it. We also need to consider the performance impact. So let's discuss more on the issue first.

In the future, please don't jump at fixing stuff if (1) the reproducer still crashes (2) there is a possible performance penalty that needs to be assessed and no assessments were done. This wastes reviewer's time.

[sobolevn]

I agree that the fix is not really obvious.

[sobolevn]

can the same also happen to f_globals? f_builtins?

[yihong0618]

seems yes

[fatelei]

can the same also happen to f_globals? f_builtins?

yes