[ python-Bugs-1030557 ] PyMapping_Check crashes when argument is NULL

[SourceForge.net]

Bugs item #1030557, was opened at 2004-09-19 13:22
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=1030557&group_id=5470

Category: Python Interpreter Core
Group: Python 2.4
Status: Open
Resolution: None
Priority: 5
Submitted By: Michiel de Hoon (mdehoon)
Assigned to: Nobody/Anonymous (nobody)
Summary: PyMapping_Check crashes when argument is NULL

Initial Comment:
The function PyMapping_Check in Objects/abstract.c in
Python 2.4a3 is

int
PyMapping_Check(PyObject *o)
{
        if (PyInstance_Check(o))
                return PyObject_HasAttrString(o,
"__getitem__");

        return  o && o->ob_type->tp_as_mapping &&
                o->ob_type->tp_as_mapping->mp_subscript &&
                !(o->ob_type->tp_as_sequence &&
                  o->ob_type->tp_as_sequence->sq_slice);
}

where PyInstance_Check is #defined in
Include/classobject.h as

#define PyInstance_Check(op) ((op)->ob_type ==
&PyInstance_Type)

Hence, if the argument o of PyMapping_Check is NULL,
the function will crash. I first noticed this crash on
Cygwin.
The problem is that PyInstance_Check dereferences the
argument o before the check for o==NULL is made in the
return statement.

In Python 2.3.4, PyMapping_Check was

int
PyMapping_Check(PyObject *o)
{
        return o && o->ob_type->tp_as_mapping &&
                o->ob_type->tp_as_mapping->mp_subscript;
}

which checks for o==NULL correctly.

By the way, I am not sure if I am submitting this to
the correct category.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=1030557&group_id=5470