Skip to content

gh-153662: Fix crash when calling io.TextIOWrapper.seek() with malformed cookie #153667

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ByteFlowing1337 wants to merge 5 commits into
base: main
Choose a base branch
from
+19 −1
Open

gh-153662: Fix crash when calling io.TextIOWrapper.seek() with malformed cookie #153667

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
f5c8f10
Fix crash when calling `io.TextIOWrapper.seek` with a malformed coo
ByteFlowing1337 Jul 13, 2026
cde0ad6
Fix the news entry
ByteFlowing1337 Jul 14, 2026
b9ec776
Address review
ByteFlowing1337 Jul 14, 2026
bf5fba6
Add more test
ByteFlowing1337 Jul 14, 2026
64b052a
use support.subTests
ByteFlowing1337 Jul 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion Lib/test/test_io/test_textio.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1426,15 +1426,18 @@ def test_read_non_blocking(self):
os.close(w)

def test_seek_reject_negative_chars_to_skip(self):
Comment thread
ByteFlowing1337 marked this conversation as resolved.
Outdated
Comment thread
ByteFlowing1337 marked this conversation as resolved.
Outdated
# See https://github.com/python/cpython/issues/153662
data = b"1"
raw = io.BytesIO(data)
buf = io.BufferedReader(raw)
tio = io.TextIOWrapper(buf, encoding='utf_8')
# Set 'cookie.chars_to_skip' to INT_MIN
COOKIE_VALUE = (100 << (12 * 8)) | (0x80 << (19 * 8))
tio.read()
with self.assertRaises(OSError):
with self.assertRaises(OSError) as err:
Comment thread
ByteFlowing1337 marked this conversation as resolved.
Outdated
tio.seek(COOKIE_VALUE)
self.assertEqual(str(err.exception), "can't restore logical file position")


class MemviewBytesIO(io.BytesIO):
'''A BytesIO object whose read method returns memoryviews
Expand Down
2 changes: 1 addition & 1 deletion Modules/_io/textio.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2781,7 +2781,7 @@ _io_TextIOWrapper_seek_impl(textio *self, PyObject *cookieObj, int whence)
textiowrapper_set_decoded_chars(self, decoded);

/* Skip chars_to_skip of the decoded characters. */
/* gh-153662: Reject negative chars_to_skip*/
/* gh-153662: Reject negative chars_to_skip */
if (cookie.chars_to_skip < 0 || PyUnicode_GetLength(self->decoded_chars) < cookie.chars_to_skip) {

@picnixz picnixz Jul 14, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't there a way to have a helper for validating this? what if the chars to skip are way too large? can we hit an overflow somehow?

@ByteFlowing1337 ByteFlowing1337 Jul 14, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think there can hardly be an overflow.

If chars_to_skip is too large, in normal cases where self->decoded_chars is not that large, it will be rejected by the second condition, and an OSError is raised.

Even in the case that chars_to_skip is as large as INT_MAX and hasn't been rejected, it's later assigned to self->decoded_chars_used, which is a Py_ssize_t which is hard to overflow on 64-bit platforms.

@picnixz picnixz Jul 14, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It may be hard but it can be crafted, as we did in your tests. So if possible, please add some more tests with malformed cookie values.

PyErr_SetString(PyExc_OSError, "can't restore logical file position");
goto fail;
Expand Down
Loading