Python空指针引用漏洞怎么解决
本篇内容介绍了“ Python空指针引用漏洞怎么解决”的有关知识，在实际案例的操作过程中，不少人都会遇到这样的困境，接下来就让小编带领大家学习一下如何处理这些情况吧！希望大家仔细阅读，能够学有所成！
网站建设公司,为您提供网站建设,网站制作,网页设计及定制网站建设服务,专注于企业网站建设,高端网页制作,对围栏护栏等多个行业拥有丰富的网站建设经验的网站建设公司。专业网站设计,网站优化推广哪家好,专业网站推广优化,H5建站,响应式网站。
漏洞简介:
Python最新版Python 3.8.5的空指针引用漏洞发生在Python对.pyc文件进行处理时。
下面是崩溃信息：
$ Python-3.8.5/python 00-SEGV-on-unknown-address-Python-3.8.5.pyc Could not find platform dependent librariesConsider setting $PYTHONHOME to [: ] AddressSanitizer:DEADLYSIGNAL ================================================================= ==8079==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x0000008aa86b bp 0x000000000000 sp 0x7ffe2a3f5bf0 T0) ==8079==The signal is caused by a READ memory access. ==8079==Hint: address points to the zero page. #0 0x8aa86a in _PyEval_EvalCodeWithName /home/test/Python-3.8.5/Python/ceval.c:4266:23 #1 0x866d0f in PyEval_EvalCodeEx /home/test/Python-3.8.5/Python/ceval.c:4327:12 #2 0x866d0f in PyEval_EvalCode /home/test/Python-3.8.5/Python/ceval.c:718:12 #3 0x9f7355 in run_eval_code_obj /home/test/Python-3.8.5/Python/pythonrun.c:1125:9 #4 0x9e682d in run_pyc_file /home/test/Python-3.8.5/Python/pythonrun.c:1184:9 #5 0x9e682d in PyRun_SimpleFileExFlags /home/test/Python-3.8.5/Python/pythonrun.c:419:13 #6 0x9e4ca5 in PyRun_AnyFileExFlags /home/test/Python-3.8.5/Python/pythonrun.c:86:16 #7 0x5108db in pymain_run_file /home/test/Python-3.8.5/Modules/main.c:381:15 #8 0x5108db in pymain_run_python /home/test/Python-3.8.5/Modules/main.c:606:21 #9 0x5108db in Py_RunMain /home/test/Python-3.8.5/Modules/main.c:685:5 #10 0x5129d6 in pymain_main /home/test/Python-3.8.5/Modules/main.c:715:12 #11 0x512dd7 in Py_BytesMain /home/test/Python-3.8.5/Modules/main.c:739:12 #12 0x7f8316d4b82f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291 #13 0x438888 in _start (/home/test/Python-3.8.5-Fuzz/python+0x438888) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /home/test/Python-3.8.5/Python/ceval.c:4266:23 in _PyEval_EvalCodeWithName ==8079==ABORTING
漏洞分析:
在函数PyEval_EvalCode(Python-3.8.5/Python/ceval.c)中调用PyEval_EvalCodeEx函数。
PyObject * PyEval_EvalCode(PyObject *co, PyObject *globals, PyObject *locals){ return PyEval_EvalCodeEx(co, globals, locals, (PyObject **)NULL, 0, (PyObject **)NULL, 0, (PyObject **)NULL, 0, NULL, NULL); }传递给PyEval_EvalCodeEx函数的参数中closure设置为NULL。
PyObject * PyEval_EvalCodeEx(PyObject *_co, PyObject *globals, PyObject *locals, PyObject *const *args, int argcount, PyObject *const *kws, int kwcount, PyObject *const *defs, int defcount, PyObject *kwdefs, PyObject *closure){ return _PyEval_EvalCodeWithName(_co, globals, locals, args, argcount, kws, kws != NULL ? kws + 1 : NULL, kwcount, 2, defs, defcount, kwdefs, closure, NULL, NULL); }PyEval_EvalCodeEx函数继续调用_PyEval_EvalCodeWithName函数，closure值不变依旧为NULL。
PyObject * _PyEval_EvalCodeWithName(PyObject *_co, PyObject *globals, PyObject *locals, PyObject *const *args, Py_ssize_t argcount, PyObject *const *kwnames, PyObject *const *kwargs, Py_ssize_t kwcount, int kwstep, PyObject *const *defs, Py_ssize_t defcount, PyObject *kwdefs, PyObject *closure, PyObject *name, PyObject *qualname) { ****** /* Copy closure variables to free variables */ for (i = 0; i < PyTuple_GET_SIZE(co->co_freevars); ++i) { PyObject *o = PyTuple_GET_ITEM(closure, i); <----------------------------- crash Py_INCREF(o); freevars[PyTuple_GET_SIZE(co->co_cellvars) + i] = o; } ****** }修复建议:
在 _PyEval_EvalCodeWithName函数中引用closure前，对closure的值进行判断。
“ Python空指针引用漏洞怎么解决”的内容就介绍到这里了，感谢大家的阅读。如果想了解更多行业相关的知识可以关注创新互联网站，小编将为大家输出更多高质量的实用文章！
分享文章：Python空指针引用漏洞怎么解决
文章分享：http://mswzjz.cn/article/ppdoph.html