[New-bugs-announce] [issue31728] crashes in _elementtree due to unsafe decrefs of Element.text and Element.tail

[Oren Milman]

New submission from Oren Milman <orenmn at gmail.com>:

The following code causes the interpreter to crash:
import xml.etree.ElementTree
class X:
    def __del__(self):
        elem.clear()
elem = xml.etree.ElementTree.Element('elem')
elem.text = X()
elem.clear()

This is because _elementtree_Element_clear_impl() decrefs self->text in an
unsafe manner.
For the same reason, but for self->tail, a crash would happen if we replaced
'elem.text = X()' with 'elem.tail = X()'.


Similarly, the following code also causes the interpreter to crash:
import xml.etree.ElementTree
class X:
    def __del__(self):
        elem.clear()
elem = xml.etree.ElementTree.Element('elem')
elem.text = X()
elem.text = X()

This is because element_text_setter() decrefs self->text in an unsafe manner.
element_tail_setter() does the same for self->tail, so again, if we replaced
'elem.text = X()' with 'elem.tail = X()', we would also get a crash.

----------
components: XML
messages: 303917
nosy: Oren Milman
priority: normal
severity: normal
status: open
title: crashes in _elementtree due to unsafe decrefs of Element.text and Element.tail
type: crash
versions: Python 3.7

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue31728>
_______________________________________