Skip to content

gh-143637: Fix re-entrant mutation of ancillary data in socket.sendmsg() #143892

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
priyanshu2282-cyber wants to merge 14 commits into
base: main
Choose a base branch
from
+37 −5
Open

gh-143637: Fix re-entrant mutation of ancillary data in socket.sendmsg() #143892

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
597c672
socket: fix re-entrant mutation in sendmsg ancillary data
priyanshu2282-cyber Jan 15, 2026
7e57097
test_socket: add regression test for sendmsg re-entrancy
priyanshu2282-cyber Jan 15, 2026
a6fbd4b
gh-143637: Fix reentrant mutation crash in socket.sendmsg
priyanshu2282-cyber Jan 15, 2026
be7371d
chore: rerun CI
priyanshu2282-cyber Jan 16, 2026
4703c2b
restore spacing style for controllen calculation
priyanshu2282-cyber Jan 17, 2026
2bd7e14
📜🤖 Added by blurb_it.
blurb-it[bot] Jan 17, 2026
710daaa
add public wrapper for sendmsg re-entrant ancillary mutation test
priyanshu2282-cyber Jan 17, 2026
a2992a8
Merge branch 'fix-sendmsg-reentrant-cmsg' of https://github.com/priya…
priyanshu2282-cyber Jan 17, 2026
75d8ae9
fixed trailing whitespace
priyanshu2282-cyber Jan 17, 2026
6f0ddf4
PySequence_Tuple instead of PySequence_Fast and removed INCREF, DECREF
priyanshu2282-cyber Jan 17, 2026
ff8af98
Fix trailing whitespace
priyanshu2282-cyber Jan 17, 2026
5f0a05a
Fix sendmsg re-entrant ancillary mutation crash
priyanshu2282-cyber Jan 19, 2026
082e6b7
Corrected Indentation and moved test to seperate class
priyanshu2282-cyber Jan 19, 2026
fb99129
Update Modules/socketmodule.c
priyanshu2282-cyber Jan 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions Lib/test/test_socket.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7491,6 +7491,32 @@ def detach():
pass


class SendmsgReentrancyTests(unittest.TestCase):
Copy link
Member

@vstinner vstinner Jan 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not adding the test to SendmsgStreamTests?

Copy link
Contributor Author

@priyanshu2282-cyber priyanshu2282-cyber Jan 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have tried it but the test are failing so I decided it move it into a seperate class.

Copy link
Member

@vstinner vstinner Jan 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What was the error?

Copy link
Contributor Author

@priyanshu2282-cyber priyanshu2282-cyber Jan 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AttributeError: 'SendmsgUnixStreamTest' object has no attribute '_test_sendmsg_reentrant_ancillary_mutation'. Did you mean: 'test_sendmsg_reentrant_ancillary_mutation'?

AttributeError: 'SendmsgTCPTest' object has no attribute '_test_sendmsg_reentrant_ancillary_mutation'. Did you mean: 'test_sendmsg_reentrant_ancillary_mutation'?

got these two errors instead removing private method completely.

Copy link
Contributor Author

@priyanshu2282-cyber priyanshu2282-cyber Jan 19, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to what I got is SendmsgStreamTests the class adds _ prefix internally before the method name, just to confirm. I mean by looking the class, Is this class expects _test_* implementation for each test_* method.


@unittest.skipUnless(hasattr(socket.socket, "sendmsg"),
"sendmsg not supported")
def test_sendmsg_reentrant_ancillary_mutation(self):

class Mut:
def __index__(self):
seq.clear()
return 0

seq = [
(socket.SOL_SOCKET, Mut(), b'x'),
(socket.SOL_SOCKET, 0, b'x'),
]

left, right = socket.socketpair()
self.addCleanup(left.close)
self.addCleanup(right.close)
self.assertRaises(
(TypeError, OSError),
left.sendmsg,
[b'x'],
seq,
)

def setUpModule():
thread_info = threading_helper.threading_setup()
unittest.addModuleCleanup(threading_helper.threading_cleanup, *thread_info)
Expand Down
1 change: 1 addition & 0 deletions Misc/NEWS.d/next/Library/2026-01-17-08-44-25.gh-issue-143637.qyPqDo.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Fixed a crash in socket.sendmsg() that could occur if ancillary data is mutated re-entrantly during argument parsing.
15 changes: 10 additions & 5 deletions Modules/socketmodule.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4977,11 +4977,13 @@ _socket_socket_sendmsg_impl(PySocketSockObject *s, PyObject *data_arg,
if (cmsg_arg == NULL)
ncmsgs = 0;
else {
if ((cmsg_fast = PySequence_Fast(cmsg_arg,
"sendmsg() argument 2 must be an "
"iterable")) == NULL)
cmsg_fast = PySequence_Tuple(cmsg_arg);
if (cmsg_fast == NULL) {
PyErr_SetString(PyExc_TypeError,
"sendmsg() argument 2 must be an iterable");
goto finally;
ncmsgs = PySequence_Fast_GET_SIZE(cmsg_fast);
}
ncmsgs = PyTuple_GET_SIZE(cmsg_fast);
}

#ifndef CMSG_SPACE
Expand All @@ -5001,8 +5003,11 @@ _socket_socket_sendmsg_impl(PySocketSockObject *s, PyObject *data_arg,
controllen = controllen_last = 0;
while (ncmsgbufs < ncmsgs) {
size_t bufsize, space;
PyObject *item;

item = PyTuple_GET_ITEM(cmsg_fast, ncmsgbufs);

if (!PyArg_Parse(PySequence_Fast_GET_ITEM(cmsg_fast, ncmsgbufs),
if (!PyArg_Parse(item,
"(iiy*):[sendmsg() ancillary data items]",
&cmsgs[ncmsgbufs].level,
&cmsgs[ncmsgbufs].type,
Expand Down
Loading