gh-143637: Fix re-entrant mutation of ancillary data in socket.sendmsg() by priyanshu2282-cyber · Pull Request #143892 · python/cpython

priyanshu2282-cyber · 2026-01-15T20:43:38Z

Fix a crash in socket.sendmsg() caused by re-entrant mutation of ancillary data during argument parsing.
Hold a strong reference to each ancillary item while parsing to avoid use-after-free, and added a regression test.

Issue: Heap out-of-bound read in socket.sendmsg ancillary parser after re-entrant __index__ clears the control list #143637

priyanshu2282-cyber · 2026-01-15T21:43:05Z

Hi, this PR fixes an internal correctness issue in socket.sendmsg().
Would it be appropriate to add the skip news label?

picnixz · 2026-01-17T06:03:39Z

No. It remains uaerfacing. In general, every bug fix should be announced if it can be seen only with pure python code and the public API

Modules/socketmodule.c

Lib/test/test_socket.py

bedevere-app · 2026-01-17T06:05:14Z

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

priyanshu2282-cyber · 2026-01-17T08:46:14Z

Thanks for guiding, I have added the news entry.

priyanshu2282-cyber · 2026-01-17T09:40:48Z

I have made the requested changes; please review again.

bedevere-app · 2026-01-17T09:40:53Z

Thanks for making the requested changes!

@picnixz: please review the changes made to this pull request.

…nshu2282-cyber/cpython into fix-sendmsg-reentrant-cmsg

Lib/test/test_socket.py

Modules/socketmodule.c

Lib/test/test_socket.py

vstinner

I ran the test on unmodified Python, it does crash as expected:

test_sendmsg_reentrant_ancillary_mutation (test.test_socket.GeneralModuleTests.test_sendmsg_reentrant_ancillary_mutation) ...
Fatal Python error: Segmentation fault

Co-authored-by: Victor Stinner <vstinner@python.org>

picnixz's review has been addressed.

vstinner · 2026-01-21T13:35:31Z

"All required checks pass" failed with:

Error: The template is not valid. .github/workflows/build.yml (Line: 720, Col: 24): Error reading JToken from JsonReader. Path '', line 0, position 0.

I'm not sure what's going on. Let me try to update this branch, maybe it will magically fix thei ssue?

vstinner

LGTM.

@picnixz: Do you want to double check this PR?

Lib/test/test_socket.py

Modules/socketmodule.c

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

priyanshu2282-cyber · 2026-02-13T12:24:47Z

@vstinner @picnixz Is this PR needs any further changes from my side happy to adjust if required.

miss-islington-app · 2026-02-13T15:35:56Z

Thanks @priyanshu2282-cyber for the PR, and @vstinner for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

miss-islington-app · 2026-02-13T15:35:56Z

Thanks @priyanshu2282-cyber for the PR, and @vstinner for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

…sendmsg() (pythonGH-143892) (cherry picked from commit 82b92e3) Co-authored-by: Priyanshu Singh <priyanshu2282@gmail.com> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com> Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

bedevere-app · 2026-02-13T15:36:10Z

GH-144785 is a backport of this pull request to the 3.13 branch.

bedevere-app · 2026-02-13T15:36:16Z

GH-144786 is a backport of this pull request to the 3.14 branch.

vstinner · 2026-02-13T15:36:41Z

Merged, thanks for your fix.

….sendmsg() (GH-143892) (#144785) gh-143637: Fix re-entrant mutation of ancillary data in socket.sendmsg() (GH-143892) (cherry picked from commit 82b92e3) Co-authored-by: Priyanshu Singh <priyanshu2282@gmail.com> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com> Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

priyanshu2282-cyber · 2026-02-13T16:40:40Z

Thanks for the review and guidance.

….sendmsg() (GH-143892) (#144786) gh-143637: Fix re-entrant mutation of ancillary data in socket.sendmsg() (GH-143892) (cherry picked from commit 82b92e3) Co-authored-by: Priyanshu Singh <priyanshu2282@gmail.com> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com> Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

priyanshu2282-cyber added 2 commits January 16, 2026 02:06

socket: fix re-entrant mutation in sendmsg ancillary data

597c672

test_socket: add regression test for sendmsg re-entrancy

7e57097

bedevere-app bot added the awaiting review label Jan 15, 2026

bedevere-app bot mentioned this pull request Jan 15, 2026

Heap out-of-bound read in socket.sendmsg ancillary parser after re-entrant __index__ clears the control list #143637

Closed

pythongh-143637: Fix reentrant mutation crash in socket.sendmsg

a6fbd4b

chore: rerun CI

be7371d

picnixz previously requested changes Jan 17, 2026

View reviewed changes

Modules/socketmodule.c Outdated Show resolved Hide resolved

Modules/socketmodule.c Outdated Show resolved Hide resolved

Lib/test/test_socket.py Outdated Show resolved Hide resolved

bedevere-app bot removed the awaiting review label Jan 17, 2026

bedevere-app bot added the awaiting changes label Jan 17, 2026

priyanshu2282-cyber and others added 2 commits January 17, 2026 14:06

restore spacing style for controllen calculation

4703c2b

📜🤖 Added by blurb_it.

2bd7e14

bedevere-app bot added awaiting change review and removed awaiting changes labels Jan 17, 2026

bedevere-app bot requested a review from picnixz January 17, 2026 09:40

priyanshu2282-cyber added 5 commits January 17, 2026 21:27

add public wrapper for sendmsg re-entrant ancillary mutation test

710daaa

Merge branch 'fix-sendmsg-reentrant-cmsg' of https://github.com/priya…

a2992a8

…nshu2282-cyber/cpython into fix-sendmsg-reentrant-cmsg

fixed trailing whitespace

75d8ae9

PySequence_Tuple instead of PySequence_Fast and removed INCREF, DECREF

6f0ddf4

Fix trailing whitespace

ff8af98

tonghuaroot mentioned this pull request Jan 18, 2026

gh-143988: tation crashes in socket sendmsg/recvmsg_into via __buffer__ #143987

Open

Fix sendmsg re-entrant ancillary mutation crash

5f0a05a

vstinner reviewed Jan 19, 2026

View reviewed changes

Corrected Indentation and moved test to seperate class

082e6b7

vstinner reviewed Jan 19, 2026

View reviewed changes

Lib/test/test_socket.py Outdated Show resolved Hide resolved

vstinner reviewed Jan 21, 2026

View reviewed changes

Update Lib/test/test_socket.py

b299085

Co-authored-by: Victor Stinner <vstinner@python.org>

bedevere-app bot added awaiting review and removed awaiting change review labels Jan 21, 2026

Merge branch 'main' into fix-sendmsg-reentrant-cmsg

138a5df

vstinner approved these changes Jan 21, 2026

View reviewed changes

bedevere-app bot added awaiting merge and removed awaiting review labels Jan 21, 2026

picnixz reviewed Jan 21, 2026

View reviewed changes

Lib/test/test_socket.py Outdated Show resolved Hide resolved

Modules/socketmodule.c Show resolved Hide resolved

Update Lib/test/test_socket.py

da0f263

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

vstinner merged commit 82b92e3 into python:main Feb 13, 2026
47 checks passed

bedevere-app bot removed the awaiting merge label Feb 13, 2026

vstinner added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Feb 13, 2026

bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Feb 13, 2026

bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Feb 13, 2026

priyanshu2282-cyber deleted the fix-sendmsg-reentrant-cmsg branch February 13, 2026 16:40

Uh oh!

Conversation

priyanshu2282-cyber commented Jan 15, 2026 • edited by bedevere-app bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

priyanshu2282-cyber commented Jan 15, 2026

Uh oh!

picnixz commented Jan 17, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bedevere-app bot commented Jan 17, 2026

Uh oh!

priyanshu2282-cyber commented Jan 17, 2026

Uh oh!

priyanshu2282-cyber commented Jan 17, 2026

Uh oh!

bedevere-app bot commented Jan 17, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vstinner left a comment

Choose a reason for hiding this comment

Uh oh!

vstinner commented Jan 21, 2026

Uh oh!

vstinner left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

priyanshu2282-cyber commented Feb 13, 2026

Uh oh!

Uh oh!

miss-islington-app bot commented Feb 13, 2026

Uh oh!

miss-islington-app bot commented Feb 13, 2026

Uh oh!

bedevere-app bot commented Feb 13, 2026

Uh oh!

bedevere-app bot commented Feb 13, 2026

Uh oh!

vstinner commented Feb 13, 2026

Uh oh!

priyanshu2282-cyber commented Feb 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

priyanshu2282-cyber commented Jan 15, 2026 •

edited by bedevere-app bot

Loading