Evil call_soon may cause OOB in future_schedule_callbacks

[picnixz]

Crash report

Bug description:

In future_schedule_callbacks, the length of the callback list is assumed to be constant, but an evil call_soon can make it change.

PoC:

import asyncio
called_on_fut_callback0 = False

pad = lambda: ...

def evil_call_soon(*args, **kwargs):
    global called_on_fut_callback0
    if called_on_fut_callback0:
        # Called when handling fut->fut_callbacks[0]
        # and mutates the length fut->fut_callbacks.
        fut.remove_done_callback(int)
        fut.remove_done_callback(pad)
    else:
        called_on_fut_callback0 = True

fake_event_loop = lambda: ...
fake_event_loop.call_soon = evil_call_soon
fake_event_loop.get_debug = lambda: False  # suppress traceback
fut = asyncio.Future(loop=fake_event_loop)
fut.add_done_callback(str)  # sets fut->fut_callback0
fut.add_done_callback(int)  # sets fut->fut_callbacks[0]
fut.add_done_callback(pad)  # sets fut->fut_callbacks[1]
fut.add_done_callback(pad)  # sets fut->fut_callbacks[2]
fut.set_result("boom")

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs

• gh-125969: fix OOB in future_schedule_callbacks due to an evil call_soon #125970
• [3.13] gh-125969: fix OOB in future_schedule_callbacks due to an evil call_soon (GH-125970) #125991
• [3.12] gh-125969: fix OOB in future_schedule_callbacks due to an evil call_soon (GH-125970) #125992

[kumaraditya303]

thanks