Use After Free in initContext(_lsprof.c) about cpython

[gaogaotiantian]

Confirmed on main. @Eclips4 and @Zheaoli , did you use --with-address-sanitizer?

So this is a very rare case, or rather an explicit case to crash the profiler. I can't think of any real use case where stopping a profiler inside the timer function makes sense. It's a very interesting hack, but not that meaningful in the real world.

We can do some heuristics to check this rare case, but the profiler itself is kind of performance sensitive. I don't want to make it any slower in most real-world cases. So I'll make a PR to detect if an external timer changes the profiler context and if so, write a warning (unraisable exception). This way the user would know that they are doing something crazy.

There's no way for us to propagate the exception from there because it returns a time. This has no effect in normal cases where an internal timer is used. I think this is a good middle ground to address this issue.

I believe even with the evil code, in most case this won't crash because the memory is not really "freed". You need ASAN to report this. So having an extra exception look reasonable to me.

The alternative is to do a PyErr_Occured check every time we uses call_timer() before we assign it to anything. We can protect it with the externel timer check but still some overhead. I'm not the security expert and from my perspective it seems very difficult to utilize this problem.

[gaogaotiantian]

After some investigation on this. I don't believe there's a quick and clean fix to check this. I think the best way is not to free the memory of profile context when the profiler is disabled. Only free when the profiler itself is released. I made the PR and it fixed the issue.

[Eclips4]

I cannot reproduce it using your example on current main branch, debug build, macOS.

[Zheaoli]

I cannot reproduce it using your example on current main branch, debug build, macOS.

The same, I cannot reproduce the issue with the poc code for O3 or debug build in Linux with main branch

[gaogaotiantian]

Oh we actually do have an ASAN check. Maybe I'll have to make it work with ASAN.