From 4b013ec3ff688b8dc3af0cc9159a5fc4c27d8d20 Mon Sep 17 00:00:00 2001
From: Jeff Epler <jepler@gmail.com>
Date: Fri, 8 Aug 2025 08:53:14 -0500
Subject: [PATCH] extmod/vfs_reader: Check that open() resulted in a file-like
 object.

That is, an object whose type defines the protocol slot.

Note that due to protocol confusion, a variant of the original crasher that
returned e.g., a machine.Pin instance could still lead to a crash (#17852).

Fixes issue #17841.

Signed-off-by: Jeff Epler <jepler@gmail.com>
Signed-off-by: Jeff Epler <jepler@unpythonic.net>
---
 extmod/vfs_reader.c                       |  2 +-
 tests/micropython/builtin_execfile.py     | 21 +++++++++++++++++++++
 tests/micropython/builtin_execfile.py.exp |  3 +++
 3 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/extmod/vfs_reader.c b/extmod/vfs_reader.c
index de5c4e03d3..6c36770295 100644
--- a/extmod/vfs_reader.c
+++ b/extmod/vfs_reader.c
@@ -83,7 +83,7 @@ void mp_reader_new_file(mp_reader_t *reader, qstr filename) {
     };
     mp_obj_t file = mp_vfs_open(MP_ARRAY_SIZE(args), &args[0], (mp_map_t *)&mp_const_empty_map);
 
-    const mp_stream_p_t *stream_p = mp_get_stream(file);
+    const mp_stream_p_t *stream_p = mp_get_stream_raise(file, MP_STREAM_OP_READ);
     int errcode = 0;
 
     #if MICROPY_VFS_ROM
diff --git a/tests/micropython/builtin_execfile.py b/tests/micropython/builtin_execfile.py
index 75a867bb94..4fd4d66d4e 100644
--- a/tests/micropython/builtin_execfile.py
+++ b/tests/micropython/builtin_execfile.py
@@ -75,3 +75,24 @@ except TypeError:
 
 # Unmount the VFS object.
 vfs.umount(fs)
+
+
+class EvilFilesystem:
+    def mount(self, readonly, mkfs):
+        print("mount", readonly, mkfs)
+
+    def umount(self):
+        print("umount")
+
+    def open(self, file, mode):
+        return None
+
+
+fs = EvilFilesystem()
+vfs.mount(fs, "/test_mnt")
+try:
+    execfile("/test_mnt/test.py")
+    print("ExecFile succeeded")
+except OSError:
+    print("OSError")
+vfs.umount(fs)
diff --git a/tests/micropython/builtin_execfile.py.exp b/tests/micropython/builtin_execfile.py.exp
index 49703d5707..d93dee547b 100644
--- a/tests/micropython/builtin_execfile.py.exp
+++ b/tests/micropython/builtin_execfile.py.exp
@@ -5,3 +5,6 @@ open /test.py rb
 123
 TypeError
 umount
+mount False False
+OSError
+umount