This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: fix obscure crash in descriptor handling
Type: Stage:
Components: Interpreter Core Versions: Python 2.4
process
Status: closed Resolution: accepted
Dependencies: Superseder:
Assigned To: mwh Nosy List: mwh, rhettinger
Priority: normal Keywords: patch

Created on 2003-08-07 15:32 by mwh, last changed 2022-04-10 16:10 by admin. This issue is now closed.

Files
File name Uploaded Description Edit
fix-descr-hole-2.diff mwh, 2003-08-11 17:42 fix #2
fix-descr-hole-3.diff mwh, 2003-08-12 10:21 fix #3
Messages (8)
msg44407 - (view) Author: Michael Hudson (mwh) (Python committer) Date: 2003-08-07 15:32
Ages & ages back twouters pointed out a potential hole in 
PyObject_GenericGetAttr.  I've come up with a testcase & a 
fix, attached to this report.

Are there any other bits of code shaped like 
PyObject_GenericGetAttr?  I've fixed type_getattro.
msg44408 - (view) Author: Michael Hudson (mwh) (Python committer) Date: 2003-08-11 17:38
Logged In: YES 
user_id=6656

upload new patch that has a test that doesn't call gc.get_referrers 
on the integer 1 and thus create uncollectable cycles (or 
something like that, anyway).
msg44409 - (view) Author: Michael Hudson (mwh) (Python committer) Date: 2003-08-11 17:42
Logged In: YES 
user_id=6656

trying to attach again, grr
msg44410 - (view) Author: Raymond Hettinger (rhettinger) * (Python committer) Date: 2003-08-12 00:36
Logged In: YES 
user_id=80475

In typeobject.c, eliminate the else-block so that it is obvious 
that the incref always gets executed before the block ends.

Also, the first XDECREF (on line 2022) needs to be 
repositioned (to later in the block) because, in MSVC++, the 
descrgetfunc declaration (two lines below) needs to be the 
first line in the code block.

The final exit path (marked "give up") also need a DECREF.

In object.c, the DECREF on line 1459 should be a XDECREF 
and the final exit path (running PyErr_Format) also needs a 
XDECREF.

This is labelled as a Py2.4 patch but it should probably be 
backported also.

msg44411 - (view) Author: Michael Hudson (mwh) (Python committer) Date: 2003-08-12 10:21
Logged In: YES 
user_id=6656

First two comments: thanks, I've uploaded a new version with
these taken on board.

> In object.c, the DECREF on line 1459 should be a XDECREF 

No.  Look where f came from.

> and the final exit path (running PyErr_Format) also needs a 
> XDECREF.

I object to putting in Py_XDECREF(foo) when I know foo ==
NULL.  Or am I missing something? (this same applies to the
similar comment about typeobject.c).

> This is labelled as a Py2.4 patch but it should probably be 
> backported also.

Oh yes, this applies to 2.3 and almost surely 2.2, too.

Back to you.
msg44412 - (view) Author: Raymond Hettinger (rhettinger) * (Python committer) Date: 2003-08-14 19:48
Logged In: YES 
user_id=80475

This code in the section is as clear as mud.  After several 
tries, I was able to see why the XDECREF was not needed.
msg44413 - (view) Author: Raymond Hettinger (rhettinger) * (Python committer) Date: 2003-08-15 04:33
Logged In: YES 
user_id=80475

P.S.  It's not your code that's unclear; rather, the whole 
function is a nest of interdependencies, cyclomatic 
complexities, and too much activity between setting a state 
and something that depends on the state.
msg44414 - (view) Author: Michael Hudson (mwh) (Python committer) Date: 2003-08-15 13:10
Logged In: YES 
user_id=6656

Thanks for spending the brain cells on this!

Checked in as:

Objects/object.c revision 2.210
Objects/typeobject.c revision 2.244
Lib/test/test_descr.py revision 1.198

A large part of the obscurity in PyObject_GenericGetAttr
comes from the inlining of _PyType_Lookup &
PyObject_GetDictPtr.  I really hope that it's worth it...
History
Date User Action Args
2022-04-10 16:10:33adminsetgithub: 39031
2003-08-07 15:32:37mwhcreate