Issue #28275: Clean up to avoid use-after-free after bzip decompress failure

diff --git a/Lib/test/test_bz2.py b/Lib/test/test_bz2.py
index a1e4b8d8e296bf68535e903e4065e4cf1162731b..478921a1d2a8b39b68355e6c570f0aa1dbc48421 100644 (file)
--- a/Lib/test/test_bz2.py
+++ b/Lib/test/test_bz2.py
@@ -821,6 +821,12 @@ class BZ2DecompressorTest(BaseTest):
         out.append(bzd.decompress(self.DATA[300:]))
         self.assertEqual(b''.join(out), self.TEXT)
 
+    def test_failure(self):
+        bzd = BZ2Decompressor()
+        self.assertRaises(Exception, bzd.decompress, self.BAD_DATA * 30)
+        # Previously, a second call could crash due to internal inconsistency
+        self.assertRaises(Exception, bzd.decompress, self.BAD_DATA * 30)
+
 class CompressDecompressTest(BaseTest):
     def testCompress(self):
         data = bz2.compress(self.TEXT)

diff --git a/Lib/test/test_lzma.py b/Lib/test/test_lzma.py
index afd276725bf4ae5081df84b4e669a62d465de448..16e89d5a9e97941dc5ce97cbd8bba79d8a07dacc 100644 (file)
--- a/Lib/test/test_lzma.py
+++ b/Lib/test/test_lzma.py
@@ -249,11 +249,9 @@ class CompressorDecompressorTestCase(unittest.TestCase):
     def test_decompressor_bug_28275(self):
         # Test coverage for Issue 28275
         lzd = LZMADecompressor()
-        for i in range(2):
-            try:
-                lzd.decompress(COMPRESSED_RAW_1)
-            except LZMAError:
-                pass
+        self.assertRaises(LZMAError, lzd.decompress, COMPRESSED_RAW_1)
+        # Previously, a second call could crash due to internal inconsistency
+        self.assertRaises(LZMAError, lzd.decompress, COMPRESSED_RAW_1)
 
     # Test that LZMACompressor->LZMADecompressor preserves the input data.
 

diff --git a/Misc/NEWS b/Misc/NEWS
index 136247e8e9940fe836272ee3724323345faa0406..c001fc73261e629bdd17d2ec8785689335ce036d 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -95,7 +95,8 @@ Library
   that they don't call itermonthdates() which can cause datetime.date
   under/overflow.
 
-- Issue #28275: Fixed possible use adter free in LZMADecompressor.decompress().
+- Issue #28275: Fixed possible use after free in the decompress()
+  methods of the LZMADecompressor and BZ2Decompressor classes.
   Original patch by John Leitch.
 
 - Issue #27897: Fixed possible crash in sqlite3.Connection.create_collation()

diff --git a/Modules/_bz2module.c b/Modules/_bz2module.c
index e3e0eb1f23d17e6b91d1c389189d67f42d838931..67e1b657f6f3142b63576b863ebab973b60ba489 100644 (file)
--- a/Modules/_bz2module.c
+++ b/Modules/_bz2module.c
@@ -534,8 +534,10 @@ decompress(BZ2Decompressor *d, char *data, size_t len, Py_ssize_t max_length)
     }
 
     result = decompress_buf(d, max_length);
-    if(result == NULL)
+    if(result == NULL) {
+        bzs->next_in = NULL;
         return NULL;
+    }
 
     if (d->eof) {
         d->needs_input = 0;