Skip to content

gh-157639: Fix use-after-free when an external timer re-enters the profiler - #157648

Open
lazerg wants to merge 2 commits into
python:mainfrom
lazerg:fix-issue-157639
Open

lazerg wants to merge 2 commits into
python:mainfrom
lazerg:fix-issue-157639

Conversation

@lazerg

@lazerg lazerg commented Sep 16, 2026

Copy link
Copy Markdown

flush_unmatched() calls Stop() on a context before freeing it, and Stop() runs the external timer while that context is still the current one. A timer that calls enable() re-arms sys.monitoring mid-call, so the unmatched C return that follows reaches ptrace_leave_call() and pushes the context onto the free list. flush_unmatched() then frees it, and the next ptrace_enter_call() reads the dangling pointer.

POF_EXT_TIMER already exists to keep the external timer from reaching the profiler's state, so honour it in the two trace callbacks and drop events raised while the timer runs.

Fixes #157639

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

heap uaf in _lsprof via enable()

1 participant