[Python-checkins] python/dist/src/Objects object.c,2.162.6.2,2.162.6.3
gvanrossum@sourceforge.net
gvanrossum@sourceforge.net
Mon, 13 May 2002 11:30:42 -0700
Update of /cvsroot/python/python/dist/src/Objects
In directory usw-pr-cvs1:/tmp/cvs-serv10109/Objects
Modified Files:
Tag: release22-maint
object.c
Log Message:
Backport from 2.3:
Jim Fulton reported a segfault in dir(). A heavily proxied object
returned a proxy for __class__ whose __bases__ was also a proxy. The
merge_class_dict() helper for dir() assumed incorrectly that __bases__
would always be a tuple and used the in-line tuple API on the proxy.
Index: object.c
===================================================================
RCS file: /cvsroot/python/python/dist/src/Objects/object.c,v
retrieving revision 2.162.6.2
retrieving revision 2.162.6.3
diff -C2 -d -r2.162.6.2 -r2.162.6.3
*** object.c 5 Mar 2002 15:41:40 -0000 2.162.6.2
--- object.c 13 May 2002 18:30:40 -0000 2.162.6.3
***************
*** 1508,1519 ****
PyErr_Clear();
else {
int i, n;
! assert(PyTuple_Check(bases));
! n = PyTuple_GET_SIZE(bases);
! for (i = 0; i < n; i++) {
! PyObject *base = PyTuple_GET_ITEM(bases, i);
! if (merge_class_dict(dict, base) < 0) {
! Py_DECREF(bases);
! return -1;
}
}
--- 1508,1527 ----
PyErr_Clear();
else {
+ /* We have no guarantee that bases is a real tuple */
int i, n;
! n = PySequence_Size(bases); /* This better be right */
! if (n < 0)
! PyErr_Clear();
! else {
! for (i = 0; i < n; i++) {
! PyObject *base = PySequence_GetItem(bases, i);
! if (base == NULL) {
! Py_DECREF(bases);
! return -1;
! }
! if (merge_class_dict(dict, base) < 0) {
! Py_DECREF(bases);
! return -1;
! }
}
}