Skip to content

gh-160773: Fix use-after-free in OSError.__str__ - #160822

Open
alonfaraj wants to merge 2 commits into
python:mainfrom
alonfaraj:gh-160773-oserror-str
Open

alonfaraj wants to merge 2 commits into
python:mainfrom
alonfaraj:gh-160773-oserror-str

Conversation

@alonfaraj

@alonfaraj alonfaraj commented Oct 28, 2026 •

Copy link
Copy Markdown

Fixes #160773

OSError.__str__ passed borrowed references to its attributes (errno, strerror, filename, filename2, and winerror on Windows) to PyUnicode_FromFormat. Formatting one attribute with %S/%R can run arbitrary Python code. If that code modifies another attribute, the object being formatted can be freed while still in use.

The fix now take strong references to the attributes before formatting and release them afterwards.

Added a regression test which cover the filename and filename -> filename2 formats.

Tested on linux (Ubuntu 26.04).

@python-cla-bot

python-cla-bot Bot commented Oct 28, 2026 •

Copy link
Copy Markdown

All commit authors signed the Contributor License Agreement.

CLA signed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Use-after-free in OSError.__str__ when a formatting callback clears filename

1 participant