Skip to content

gh-143007: fix crash .TextIOWrapper.seek with a custom __int__ method detaches #143043

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
yihong0618 wants to merge 6 commits into
base: main
Choose a base branch
from
+23 −0
Open

gh-143007: fix crash .TextIOWrapper.seek with a custom __int__ method detaches #143043

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
f7cc7c4
fix: crash .TextIOWrapper.seek with a custom __int__ method detaches
yihong0618 Dec 21, 2025
1eb62a4
fix: crash .TextIOWrapper.seek with a custom __int__ method detaches
yihong0618 Dec 21, 2025
af070ea
fix: apply suggestions
yihong0618 Dec 22, 2025
6f5c111
Merge branch 'hy/close_issue_143007' of https://github.com/yihong0618…
yihong0618 Dec 22, 2025
bb5185d
fix: drop wrong fix
yihong0618 Dec 22, 2025
290be4f
fix: lint
yihong0618 Dec 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
fix: drop wrong fix 
Signed-off-by: yihong0618 <zouzou0208@gmail.com>
  • Loading branch information
@yihong0618
yihong0618 committed Dec 22, 2025
commit bb5185d1bfe9727429a7c1568f969847b0cc265d
13 changes: 2 additions & 11 deletions Modules/_io/textio.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2416,22 +2416,13 @@ typedef struct {
#endif

static int
textiowrapper_parse_cookie(textio *self, cookie_type *cookie, PyObject *cookieObj)
textiowrapper_parse_cookie(cookie_type *cookie, PyObject *cookieObj)
{
unsigned char buffer[COOKIE_BUF_LEN];
PyLongObject *cookieLong = (PyLongObject *)PyNumber_Long(cookieObj);
if (cookieLong == NULL)
return -1;

// gh-143007: PyNumber_Long can call arbitrary code through __int__
// which may detach the underlying buffer.
if (self->detached) {
Py_DECREF(cookieLong);
PyErr_SetString(PyExc_ValueError,
"underlying buffer has been detached");
return -1;
}

if (_PyLong_AsByteArray(cookieLong, buffer, sizeof(buffer),
PY_LITTLE_ENDIAN, 0, 1) < 0) {
Py_DECREF(cookieLong);
Expand Down Expand Up @@ -2646,7 +2637,7 @@ _io_TextIOWrapper_seek_impl(textio *self, PyObject *cookieObj, int whence)
/* The strategy of seek() is to go back to the safe start point
* and replay the effect of read(chars_to_skip) from there.
*/
if (textiowrapper_parse_cookie(self, &cookie, cookieObj) < 0)
if (textiowrapper_parse_cookie(&cookie, cookieObj) < 0)
goto fail;

/* Seek back to the safe start point. */
Expand Down
Loading