micropython/tests/basics
Angus Gratton 4bed614e70 py/objarray: Fix use-after-free if extending a bytearray from itself.
Two cases, one assigning to a slice.
Closes https://github.com/micropython/micropython/issues/13283

Second is extending a slice from itself, similar logic.

In both cases the problem occurs when m_renew causes realloc to move the
buffer, leaving a dangling pointer behind.

There are more complex and hard to fix cases when either argument is a
memoryview into the buffer, currently resizing to a new address breaks
memoryviews into that object.

Reproducing this bug and confirming the fix was done by running the unix
port under valgrind with GC-aware extensions.

Note in default configurations with GIL this bug exists but has no impact
(the free buffer won't be reused while the function is still executing, and
is no longer referenced after it returns).

Signed-off-by: Angus Gratton <angus@redyak.com.au>
2024-04-22 11:50:52 +10:00
..
0prelim.py
andor.py
annotate_var.py
annotate_var.py.exp
array1.py
array_add.py
array_construct.py
array_construct2.py
array_construct_endian.py
array_intbig.py
array_micropython.py
array_micropython.py.exp
assign1.py
assign_expr.py
assign_expr.py.exp
assign_expr_scope.py
assign_expr_scope.py.exp
assign_expr_syntaxerror.py
assign_expr_syntaxerror.py.exp
async_await.py
async_await.py.exp
async_await2.py
async_await2.py.exp
async_def.py
async_def.py.exp
async_for.py
async_for.py.exp
async_for2.py
async_for2.py.exp
async_syntaxerror.py
async_syntaxerror.py.exp
async_with.py
async_with.py.exp
async_with2.py
async_with2.py.exp
async_with_break.py
async_with_break.py.exp
async_with_return.py
async_with_return.py.exp
attrtuple1.py
bool1.py
boundmeth1.py
break.py
builtin_abs.py
builtin_abs_intbig.py
builtin_allany.py
builtin_bin.py
builtin_bin_intbig.py
builtin_callable.py
builtin_chr.py
builtin_compile.py
builtin_delattr.py
builtin_dir.py
builtin_divmod.py
builtin_divmod_intbig.py
builtin_ellipsis.py
builtin_enumerate.py
builtin_eval.py
builtin_eval_buffer.py
builtin_eval_error.py
builtin_exec.py
builtin_exec_buffer.py
builtin_filter.py
builtin_getattr.py
builtin_hasattr.py
builtin_hash.py
builtin_hash_gen.py
builtin_hash_intbig.py
builtin_help.py
builtin_help.py.exp
builtin_hex.py
builtin_hex_intbig.py
builtin_id.py
builtin_issubclass.py
builtin_len1.py
builtin_locals.py
builtin_map.py
builtin_minmax.py
builtin_next_arg2.py
builtin_oct.py
builtin_oct_intbig.py
builtin_ord.py
builtin_override.py
builtin_pow.py
builtin_pow3.py
builtin_pow3_intbig.py
builtin_print.py
builtin_property.py
builtin_property_inherit.py
builtin_range.py
builtin_range_attrs.py
builtin_range_binop.py
builtin_reversed.py
builtin_round.py
builtin_round_int.py
builtin_round_intbig.py
builtin_setattr.py
builtin_slice.py
builtin_sorted.py
builtin_str_hex.py
builtin_str_hex.py.exp
builtin_sum.py
builtin_type.py
builtin_zip.py
bytearray1.py
bytearray_add.py py/objarray: Fix use-after-free if extending a bytearray from itself. 2024-04-22 11:50:52 +10:00
bytearray_add_self.py
bytearray_add_self.py.exp
bytearray_append.py
bytearray_byte_operations.py
bytearray_center.py
bytearray_construct.py
bytearray_construct_array.py
bytearray_construct_endian.py
bytearray_count.py
bytearray_decode.py
bytearray_intbig.py
bytearray_partition.py
bytearray_slice_assign.py
bytes.py
bytes_add.py
bytes_add_array.py
bytes_add_bytearray.py
bytes_add_endian.py
bytes_center.py
bytes_compare.py
bytes_compare2.py
bytes_compare3.py
bytes_compare3.py.exp
bytes_compare_array.py
bytes_compare_bytearray.py
bytes_construct.py
bytes_construct_array.py
bytes_construct_bytearray.py
bytes_construct_endian.py
bytes_construct_intbig.py
bytes_count.py
bytes_find.py
bytes_format_modulo.py
bytes_format_modulo.py.exp
bytes_gen.py
bytes_large.py
bytes_mult.py
bytes_partition.py
bytes_replace.py
bytes_split.py
bytes_strip.py
bytes_subscr.py
class1.py
class2.py
class3.py
class_bases.py
class_bind_self.py
class_binop.py
class_call.py
class_contains.py
class_delattr_setattr.py
class_descriptor.py
class_dict.py
class_emptybases.py
class_getattr.py
class_inherit1.py
class_inherit_mul.py
class_inplace_op.py
class_inplace_op2.py
class_inplace_op2.py.exp
class_instance_override.py
class_item.py
class_misc.py
class_new.py
class_notimpl.py
class_number.py
class_ordereddict.py
class_ordereddict.py.exp
class_reverse_op.py
class_staticclassmethod.py
class_store.py
class_store_class.py
class_str.py
class_super.py
class_super_aslocal.py
class_super_closure.py
class_super_multinherit.py
class_super_object.py
class_use_other.py
closure1.py
closure2.py
closure_defargs.py
closure_manyvars.py
closure_namedarg.py
compare_multi.py
comprehension1.py
containment.py
continue.py
decorator.py
del_attr.py
del_deref.py
del_global.py
del_local.py
del_name.py
del_subscr.py
deque1.py
deque2.py
deque_micropython.py
deque_micropython.py.exp
deque_slice.py
dict1.py
dict2.py
dict_clear.py
dict_construct.py
dict_copy.py
dict_del.py
dict_fixed.py
dict_fixed.py.exp
dict_from_iter.py
dict_fromkeys.py
dict_fromkeys2.py
dict_get.py
dict_intern.py
dict_iterator.py
dict_pop.py
dict_popitem.py
dict_setdefault.py
dict_specialmeth.py
dict_union.py
dict_union.py.exp
dict_update.py
dict_views.py
equal.py
equal_class.py
errno1.py
errno1.py.exp
except_match_tuple.py
exception1.py
exception_chain.py
exception_chain.py.exp
exceptpoly.py
exceptpoly2.py
floordivide.py
floordivide_intbig.py
for1.py
for2.py
for3.py
for_break.py
for_else.py
for_range.py
for_return.py
frozenset1.py
frozenset_add.py
frozenset_binop.py
frozenset_copy.py
frozenset_difference.py
frozenset_set.py
fun1.py
fun2.py
fun3.py
fun_annotations.py
fun_calldblstar.py
fun_calldblstar2.py
fun_calldblstar3.py
fun_calldblstar4.py
fun_callstar.py
fun_callstardblstar.py
fun_defargs.py
fun_defargs2.py
fun_error.py
fun_error2.py
fun_globals.py
fun_kwargs.py
fun_kwonly.py
fun_kwonlydef.py
fun_kwvarargs.py
fun_largestate.py
fun_name.py
fun_str.py
fun_varargs.py
gc1.py
gen_yield_from.py
gen_yield_from_close.py
gen_yield_from_ducktype.py
gen_yield_from_exc.py
gen_yield_from_executing.py
gen_yield_from_iter.py
gen_yield_from_pending.py
gen_yield_from_send.py
gen_yield_from_stopped.py
gen_yield_from_throw.py
gen_yield_from_throw2.py
gen_yield_from_throw3.py
generator1.py
generator2.py
generator_args.py
generator_close.py
generator_closure.py
generator_exc.py
generator_name.py
generator_pend_throw.py
generator_pend_throw.py.exp
generator_pep479.py
generator_pep479.py.exp
generator_return.py
generator_send.py
generator_throw.py
generator_throw_nested.py
getattr.py
getitem.py
globals_del.py
ifcond.py
ifexpr.py
int1.py
int2.py
int_big1.py
int_big_add.py
int_big_and.py
int_big_and2.py
int_big_and3.py
int_big_cmp.py
int_big_div.py
int_big_error.py
int_big_lshift.py
int_big_mod.py
int_big_mul.py
int_big_or.py
int_big_or2.py
int_big_or3.py
int_big_pow.py
int_big_rshift.py
int_big_unary.py
int_big_xor.py
int_big_xor2.py
int_big_xor3.py
int_big_zeroone.py
int_bytes.py
int_bytes_intbig.py
int_constfolding.py
int_constfolding_intbig.py
int_divmod.py
int_divmod_intbig.py
int_divzero.py
int_intbig.py
int_parse.py
int_small.py
io_buffered_writer.py
io_buffered_writer.py.exp
io_bytesio_cow.py
io_bytesio_ext.py
io_bytesio_ext2.py
io_bytesio_ext2.py.exp
io_iobase.py
io_stringio1.py
io_stringio_base.py
io_stringio_with.py
io_write_ext.py
io_write_ext.py.exp
is_isnot.py
is_isnot_literal.py
is_isnot_literal.py.exp
iter0.py
iter1.py
iter2.py
iter_of_iter.py
lambda1.py
lambda_defargs.py
lexer.py
list1.py
list_clear.py
list_compare.py
list_copy.py
list_count.py
list_extend.py
list_index.py
list_insert.py
list_mult.py
list_pop.py
list_remove.py
list_reverse.py
list_slice.py
list_slice_3arg.py
list_slice_assign.py
list_slice_assign_grow.py
list_sort.py
list_sum.py
logic_constfolding.py
memoryerror.py
memoryerror.py.exp
memoryview1.py
memoryview2.py
memoryview_gc.py
memoryview_intbig.py
memoryview_itemsize.py
memoryview_slice_assign.py
memoryview_slice_size.py
memoryview_slice_size.py.exp
module1.py
module2.py
module2.py.exp
module_dict.py
namedtuple1.py
namedtuple_asdict.py
nanbox_smallint.py
nanbox_smallint.py.exp
object1.py
object_dict.py
object_new.py
op_error.py
op_error_bytearray.py
op_error_intbig.py
op_error_literal.py
op_error_literal.py.exp
op_error_memoryview.py
op_precedence.py
ordereddict1.py
ordereddict_eq.py
ordereddict_eq.py.exp
parser.py
parser.py.exp
python34.py
python34.py.exp
python36.py
python36.py.exp
return1.py
scope.py
scope_class.py
scope_implicit.py
self_type_check.py
seq_unpack.py
set_add.py
set_basic.py
set_binop.py
set_clear.py
set_comprehension.py
set_containment.py
set_copy.py
set_difference.py
set_discard.py
set_intersection.py
set_isdisjoint.py
set_isfooset.py
set_iter.py
set_iter_of_iter.py
set_pop.py
set_remove.py
set_specialmeth.py
set_symmetric_difference.py
set_type.py
set_union.py
set_unop.py
set_update.py
slice_attrs.py
slice_indices.py
slice_intbig.py
slice_op.py
slots_bool_len.py
special_comparisons.py
special_comparisons2.py
special_methods.py
special_methods2.py
special_methods2.py.exp
special_methods_intbig.py
stopiteration.py
string1.py
string_center.py
string_compare.py
string_count.py
string_cr_conversion.py
string_crlf_conversion.py
string_endswith.py
string_endswith_upy.py
string_endswith_upy.py.exp
string_escape.py
string_find.py
string_format.py
string_format2.py
string_format_cp310.py
string_format_cp310.py.exp
string_format_error.py
string_format_modulo.py
string_format_modulo_int.py
string_fstring.py
string_fstring_debug.py
string_fstring_debug.py.exp
string_index.py
string_istest.py
string_join.py
string_large.py
string_mult.py
string_partition.py
string_replace.py
string_repr.py
string_rfind.py
string_rindex.py
string_rpartition.py
string_rsplit.py
string_slice.py
string_split.py
string_splitlines.py
string_startswith.py
string_startswith_upy.py
string_startswith_upy.py.exp
string_strip.py
string_upperlow.py
struct1.py
struct1_intbig.py
struct2.py
struct_endian.py
struct_micropython.py
struct_micropython.py.exp
subclass_classmethod.py
subclass_native1.py
subclass_native2_list.py
subclass_native2_tuple.py
subclass_native3.py
subclass_native4.py
subclass_native5.py
subclass_native_buffer.py
subclass_native_call.py
subclass_native_call.py.exp
subclass_native_cmp.py
subclass_native_containment.py
subclass_native_exc_new.py
subclass_native_exc_new.py.exp
subclass_native_init.py
subclass_native_iter.py
subclass_native_specmeth.py
subclass_native_str.py
syntaxerror.py
syntaxerror_return.py
sys1.py
sys_exit.py
sys_getsizeof.py
sys_path.py
sys_tracebacklimit.py
sys_tracebacklimit.py.exp
true_value.py
try1.py
try2.py
try3.py
try4.py
try_as_var.py
try_continue.py
try_else.py
try_else_finally.py
try_error.py
try_except_break.py
try_except_break.py.exp
try_finally1.py
try_finally2.py
try_finally_break.py
try_finally_break2.py
try_finally_continue.py
try_finally_continue.py.exp
try_finally_loops.py
try_finally_return.py
try_finally_return2.py
try_finally_return3.py
try_finally_return4.py
try_finally_return5.py
try_reraise.py
try_reraise2.py
try_return.py
tuple1.py
tuple_compare.py
tuple_count.py
tuple_index.py
tuple_mult.py
tuple_slice.py
types1.py
types2.py
unary_op.py
unboundlocal.py
unpack1.py
while1.py
while_cond.py
while_nest_exc.py
with1.py
with_break.py
with_continue.py
with_raise.py
with_return.py