[issue28387] double free in io.TextIOWrapper

[Sebastian Cufre]

New submission from Sebastian Cufre:

We have found that you can produce a crash when an instance of _io.TextIOWrapper is being deallocated while there's another thread invoking the garbage collector. I've attached a simple script that should reproduce the issue (textiowrapper_crash.py)

Looking at the code of the _io module, we found that on the dealloc method of the TextIOWrapper class, it first tries to invoke the close method, then releases its internal members, after that removes itself from the garbage collector tracking and finally frees deallocates the remaining stuff. What happens, is that while releasing it's internal members, it might end up calling code that releases the interpreter lock (because its doing an operating system call), letting other threads execute. If for example the thread that comes in, invokes the garbage collector, on debug will raise an assert on gcmodule.c on line 351, where I understand it is complaining that it is tracking an object with refcount 0. In a release build, I suppose this goes on and will end up releasing the object (given it has a refcount of 0), and when the interrupted dealloc thread continues will end up freeing again itself which at some point produces a crash.

Attached is a proposed fix for the issue in textio.c.patch, where the it the call to _PyObject_GC_UNTRACK is now done right after the call to the close method and before release its internal members.

As a reference we have been able to reproduce this with Python 2.7.12 on Windows (i386)

----------
components: Extension Modules
files: textiowrapper_crash.py
messages: 278263
nosy: scufre
priority: normal
severity: normal
status: open
title: double free in io.TextIOWrapper
type: crash
versions: Python 2.7
Added file: http://bugs.python.org/file45004/textiowrapper_crash.py

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue28387>
_______________________________________