Skip to content

heap uaf in _lsprof via enable() #157639

Open
#157648
Open
heap uaf in _lsprof via enable()#157639
#157648
Labels
extension-modulesC modules in the Modules dirtopic-profilingtype-bugAn unexpected behavior, bug, or error

Description

@djarfluka
djarfluka
opened on Sep 16, 2026

Bug report

Bug description:

import _lsprof
prof = _lsprof.Profiler()
def _timer():
    try:
        prof.enable()        
    except Exception:
        pass
    return 0
prof.__init__(timer=_timer)
prof.enable()
def foo():
    return 1
foo()                 
prof.disable()

ASAN output (truncated:

==ERROR: AddressSanitizer: heap-use-after-free ... READ of size 8
    #0 ptrace_enter_call Modules/_lsprof.c:383
    #1 _lsprof_Profiler__ccall_callback_impl Modules/_lsprof.c:733
freed by thread T0 here:
    #1 flush_unmatched Modules/_lsprof.c:873
    #2 _lsprof_Profiler_disable_impl Modules/_lsprof.c:930
previously allocated by thread T0 here:
    #1 ptrace_enter_call Modules/_lsprof.c:388
SUMMARY: AddressSanitizer: heap-use-after-free Modules/_lsprof.c:383 in ptrace_enter_call

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    extension-modulesC modules in the Modules dirtopic-profilingtype-bugAn unexpected behavior, bug, or error

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions