Repository navigation
Out-of-bounds write in bytearray.extend() with a reentrant __buffer__ #153578
Description
Bug report
Bug description:
The C implementation of bytearray.extend() acquires the argument's buffer
(running its __buffer__()) before clamping the append range, then clamps only
the high bound to the current size. A __buffer__ that shrinks the bytearray
leaves the low bound past the high bound, so extend runs a negative-size
memmove (an out-of-bounds write; SIGABRT on a debug build).
b = bytearray(b'x' * 100)
class Evil:
def __buffer__(self, flags):
b.clear()
return memoryview(b'ABCDEFGH')
b.extend(Evil()) # out-of-bounds write
bytearray.__iadd__ re-reads the size after acquiring the buffer; extend()
does not.
CPython versions tested on:
3.13, 3.14, 3.15, 3.16
Operating systems tested on:
macOS
Linked PRs
- gh-153578: Fix out-of-bounds write in bytearray.extend() with a reentrant __buffer__ #153579
- [3.15] gh-153578: Fix out-of-bounds write in bytearray.extend() with a reentrant __buffer__ (GH-153579) #156007
- [3.14] gh-153578: Fix out-of-bounds write in bytearray.extend() with a reentrant __buffer__ (GH-153579) #156008
- [3.13] gh-153578: Fix out-of-bounds write in bytearray.extend() with a reentrant __buffer__ (GH-153579) #156009
Activity
gh-153578: Fix out-of-bounds write in bytearray.extend() with a reent…
[3.14] gh-153578: Fix out-of-bounds write in bytearray.extend() with …
[3.13] gh-153578: Fix out-of-bounds write in bytearray.extend() with …
[3.15] gh-153578: Fix out-of-bounds write in bytearray.extend() with …