You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In r_object TYPE_CODE case (line 1601-1602), when firstlineno == -1 && PyErr_Occurred(), code does break instead of goto code_error. Skips cleanup of 8 owned refs. Reachable via marshal.loads() with crafted input.
Bug report
Bug description:
Parent: #146121
https://gist.github.com/devdanzin/60b787bfa22651ba6a18aef3b6e1439d/raw/5b12fb962510aed36b457ae3670424bbb91ecacd/marshal_type_code_leak.md
In
r_objectTYPE_CODE case (line 1601-1602), whenfirstlineno == -1 && PyErr_Occurred(), code doesbreakinstead ofgoto code_error. Skips cleanup of 8 owned refs. Reachable viamarshal.loads()with crafted input.CPython versions tested on:
CPython main branch
Operating systems tested on:
No response
Linked PRs
TYPE_CODEmarshal stream #148419