CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c.
cpe:2.3:a:python:python:3.12.0:alpha7:*:*:*:*:*:*
BA2D7BE3-5AEE-42DC-892C-747202C4A542
OR
# Your environment

- CPython versions tested on: 3.12.0 alpha 7
- Operating system and architecture: ubuntu20.04.1,x86_64
- Compiler flags: clang with ASAN and UBSAN instrument

# Bug description
The AddressSanitizer (ASAN) tool has detected multiple heap-use-after-free errors and a segmentation fault (SEGV) in the Python interpreter. The heap-use-after-free errors occurred in the ascii_decode and unicode_decode_utf8 functions in the unicodeobject.c file, and the SEGV occurred in the tok_backup function in the tokenizer.c file. Additionally, a memory leak was detected in the pystate.c file.

# Steps to reproduce

1. Compile Python with ASAN enabled: `./configure  && make`
1. Run Python with ASAN enabled: `./python < poc_file`
1. The heap-use-after-free errors and SEGV should be detected and logged by ASAN.

# Expected behavior

No heap-use-after-free errors or SEGV should occur.

# Actual behavior

ASAN detected multiple heap-use-after-free errors and a SEGV, as well as a memory leak.

# Relevant logs and/or screenshots

The ASAN summary output is as follows:

```
AddressSanitizer: heap-use-after-free /src/cpython/Objects/unicodeobject.c:4474:28 in ascii_decode
AddressSanitizer: heap-use-after-free /src/cpython/Objects/unicodeobject.c:4506:28 in ascii_decode
AddressSanitizer: heap-use-after-free /src/cpython/Objects/unicodeobject.c:4483:32 in ascii_decode
AddressSanitizer: SEGV /src/cpython/Parser/tokenizer.c:1234:33 in tok_backup
AddressSanitizer: heap-use-after-free /src/cpython/Objects/unicodeobject.c:4526:37 in unicode_decode_utf8
AddressSanitizer: 3824 byte(s) leaked in 4 allocation(s).
AddressSanitizer: heap-use-after-free /src/cpython/Python/pystate.c:229:23 in bind_tstate
The full ASAN log can be found in the asan.log file.
```
[asan.log](https://github.com/python/cpython/files/11316179/asan.log)
[python_bug_poc.zip](https://github.com/python/cpython/files/11316193/python_bug_poc.zip)


<!-- gh-linked-prs -->
### Linked PRs
* gh-103993
<!-- /gh-linked-prs -->

Found Heap-use-after-free errors and SEGV in Python
This is a GitHub Issue
repo:cpython
owner:python
Title : Found Heap-use-after-free errors and SEGV in Python
Issue date:

--- start body ---
# Your environment

- CPython versions tested on: 3.12.0 alpha 7
- Operating system and architecture: ubuntu20.04.1,x86_64
- Compiler flags: clang with ASAN and UBSAN instrument

# Bug description
The AddressSanitizer (ASAN) tool has detected multiple heap-use-after-free errors and a segmentation fault (SEGV) in the Python interpreter. The heap-use-after-free errors occurred in the ascii_decode and unicode_decode_utf8 functions in the unicodeobject.c file, and the SEGV occurred in the tok_backup function in the tokenizer.c file. Additionally, a memory leak was detected in the pystate.c file.

# Steps to reproduce

1. Compile Python with ASAN enabled: `./configure  && make`
1. Run Python with ASAN enabled: `./python < poc_file`
1. The heap-use-after-free errors and SEGV should be detected and logged by ASAN.

# Expected behavior

No heap-use-after-free errors or SEGV should occur.

# Actual behavior

ASAN detected multiple heap-use-after-free errors and a SEGV, as well as a memory leak.

# Relevant logs and/or screenshots

The ASAN summary output is as follows:

```
AddressSanitizer: heap-use-after-free /src/cpython/Objects/unicodeobject.c:4474:28 in ascii_decode
AddressSanitizer: heap-use-after-free /src/cpython/Objects/unicodeobject.c:4506:28 in ascii_decode
AddressSanitizer: heap-use-after-free /src/cpython/Objects/unicodeobject.c:4483:32 in ascii_decode
AddressSanitizer: SEGV /src/cpython/Parser/tokenizer.c:1234:33 in tok_backup
AddressSanitizer: heap-use-after-free /src/cpython/Objects/unicodeobject.c:4526:37 in unicode_decode_utf8
AddressSanitizer: 3824 byte(s) leaked in 4 allocation(s).
AddressSanitizer: heap-use-after-free /src/cpython/Python/pystate.c:229:23 in bind_tstate
The full ASAN log can be found in the asan.log file.
```
[asan.log](https://github.com/python/cpython/files/11316179/asan.log)
[python_bug_poc.zip](https://github.com/python/cpython/files/11316193/python_bug_poc.zip)


<!-- gh-linked-prs -->
### Linked PRs
* gh-103993
<!-- /gh-linked-prs -->

--- end body ---

comments :
--- start comments ---

--- end comments ---