Bug 118136 – python has stack smashing issue revealed by test suite

• Status: RESOLVED DUPLICATE of bug 82469
• Product: Gentoo Security

[Description Brant Gurganus 2006-01-07 00:31:38 UTC]

If either python-2.3.5-r2 or python-2.4.2 are compiled with an SSP-enabled GCC and their test suite is run, both give an error about a stack smashing attack in symtable_node() during test_syntax. Pertinent function seems to have been replaced on the Python trunk according to http://svn.python.org/view/python/trunk/Python/compile.c?rev=39758&r1=39251&r2=39758

[Comment 1 Stefan Cornelius (RETIRED) 2006-01-12 03:01:01 UTC]

liquidx please advise

[Comment 2 Thierry Carrez (RETIRED) 2006-01-12 08:22:00 UTC]

Ccing kloeri as he did the last Python bumps.

Not too sure about this, if this is just a DoS then this should be filed as bug. Setting to Auditing so that our auditors can investigate.

Also the proposed patch is a complete rewrite of compile.c... probably not production-ready.

[Comment 3 Bryan Østergaard (RETIRED) 2006-01-16 07:25:40 UTC]

This issue is already described in bug 82469. Especially interesting is comment #12 in that bug as this looks like a toolchain issue.

Rewriting compile.c may very well "fix" this of course :)

[Comment 4 Alastair Tse (RETIRED) 2006-01-16 07:36:06 UTC]

i agree with kloeri on this. the last comment in bug #82469 shows it is a gcc problem rather than a specific python problem.

[Comment 5 Thierry Carrez (RETIRED) 2006-01-16 07:45:45 UTC]

Looks very much the same, yes.

*** This bug has been marked as a duplicate of 82469 ***