Bug report
Bug description:
In socketmodule.c, a call is made to PyThread_allocate_lock to allocate a lock, but its return value is not checked.
| #if defined(USE_GETHOSTBYNAME_LOCK) | |
| netdb_lock = PyThread_allocate_lock(); | |
| #endif |
That same netdb_lock is later used without being checked for null-ness either.
| #ifdef USE_GETHOSTBYNAME_LOCK | |
| PyThread_acquire_lock(netdb_lock, 1); | |
| #endif | |
| _Py_COMP_DIAG_PUSH | |
| _Py_COMP_DIAG_IGNORE_DEPR_DECLS | |
| h = gethostbyname(name); | |
| _Py_COMP_DIAG_POP | |
| #endif /* HAVE_GETHOSTBYNAME_R */ | |
| Py_END_ALLOW_THREADS | |
| /* Some C libraries would require addr.__ss_family instead of | |
| addr.ss_family. | |
| Therefore, we cast the sockaddr_storage into sockaddr to | |
| access sa_family. */ | |
| sa = SAS2SA(&addr); | |
| ret = gethost_common(state, h, SAS2SA(&addr), sizeof(addr), | |
| sa->sa_family); | |
| #ifdef USE_GETHOSTBYNAME_LOCK | |
| PyThread_release_lock(netdb_lock); | |
| #endif |
If PyThread_allocate_lock fails (due to being out of memory, that's the only failure case as far as I can tell), this will lead to a crash.
Backports
Once fix, the fix would have to be backported to 3.15 / 3.14 / 3.13 which have the same problem.
CPython versions tested on:
CPython main branch
Operating systems tested on:
Other, macOS
Linked PRs
- gh-150406: check result of
PyThread_allocate_lockfornetdb_lock#150407 - [3.15] gh-150406: Check result of PyThread_allocate_lock() for netdb_lock (GH-150407) #150616
- [3.14] gh-150406: Check result of PyThread_allocate_lock() for netdb_lock (GH-150407) #150617
- [3.13] gh-150406: Check result of PyThread_allocate_lock() for netdb_lock (GH-150407) #150618