[Patches] [ python-Patches-1546288 ] crash in dict_equal

[SourceForge.net]

Patches item #1546288, was opened at 2006-08-24 15:04
Message generated for change (Comment added) made by nnorwitz
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=305470&aid=1546288&group_id=5470

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Core (C code)
>Group: Python 2.6
Status: Open
>Resolution: None
>Priority: 5
Submitted By: Guido van Rossum (gvanrossum)
Assigned to: Neal Norwitz (nnorwitz)
Summary: crash in dict_equal

Initial Comment:
I initially found this bug in the py3k branch, but it's
reproducible in 2.5 as well (and probably older
versions as well, as long as they have dict_equal()). 
It can be reproduced by using the attached patch to
test_mutants.py.

The problem is in this fragment in dict_equal():

 PyObject *key = a->ma_table[i].me_key;
 /* temporarily bump aval's refcount to ensure it stays
                                                  
    alive until we're done with it */
 Py_INCREF(aval);
 bval = PyDict_GetItem((PyObject *)b, key);

The problem is that the only reference to 'key' may be
in the hash table, and test_mutants.py removes it from
the hash table, apparently before the comparison code
is done with using it. The fix is to incref/decref key
around the GetItem call.

----------------------------------------------------------------------

>Comment By: Neal Norwitz (nnorwitz)
Date: 2006-09-04 18:54

Message:
Logged In: YES 
user_id=33168

Committed revision 51713. 2.5


----------------------------------------------------------------------

Comment By: Neal Norwitz (nnorwitz)
Date: 2006-08-24 17:23

Message:
Logged In: YES 
user_id=33168

Defer until 2.5.1. I'll apply later.  (If I forget, someone
please checkin after 2.5 is out the door.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=305470&aid=1546288&group_id=5470