[Python-checkins] cpython (3.4): Issue #24097: Fixed crash in object.__reduce__() if slot name is freed inside
serhiy.storchaka
python-checkins at python.org
Wed Nov 25 11:36:04 EST 2015
https://hg.python.org/cpython/rev/eed36e19f8b8
changeset: 99356:eed36e19f8b8
branch: 3.4
parent: 99352:8d9a0540adf9
user: Serhiy Storchaka <storchaka at gmail.com>
date: Wed Nov 25 18:33:29 2015 +0200
summary:
Issue #24097: Fixed crash in object.__reduce__() if slot name is freed inside
__getattr__. Original patch by Antoine Pitrou.
files:
Lib/test/test_descr.py | 17 +++++++++++++++++
Misc/NEWS | 3 +++
Objects/typeobject.c | 3 +++
3 files changed, 23 insertions(+), 0 deletions(-)
diff --git a/Lib/test/test_descr.py b/Lib/test/test_descr.py
--- a/Lib/test/test_descr.py
+++ b/Lib/test/test_descr.py
@@ -4988,6 +4988,23 @@
objcopy2 = deepcopy(objcopy)
self._assert_is_copy(obj, objcopy2)
+ def test_issue24097(self):
+ # Slot name is freed inside __getattr__ and is later used.
+ class S(str): # Not interned
+ pass
+ class A:
+ __slotnames__ = [S('spam')]
+ def __getattr__(self, attr):
+ if attr == 'spam':
+ A.__slotnames__[:] = [S('spam')]
+ return 42
+ else:
+ raise AttributeError
+
+ import copyreg
+ expected = (copyreg.__newobj__, (A,), (None, {'spam': 42}), None, None)
+ self.assertEqual(A().__reduce__(2), expected) # Shouldn't crash
+
class SharedKeyTests(unittest.TestCase):
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@
Core and Builtins
-----------------
+- Issue #24097: Fixed crash in object.__reduce__() if slot name is freed inside
+ __getattr__.
+
- Issue #24731: Fixed crash on converting objects with special methods
__bytes__, __trunc__, and __float__ returning instances of subclasses of
bytes, int, and float to subclasses of bytes, int, and float correspondingly.
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -3768,8 +3768,10 @@
PyObject *name, *value;
name = PyList_GET_ITEM(slotnames, i);
+ Py_INCREF(name);
value = PyObject_GetAttr(obj, name);
if (value == NULL) {
+ Py_DECREF(name);
if (!PyErr_ExceptionMatches(PyExc_AttributeError)) {
goto error;
}
@@ -3778,6 +3780,7 @@
}
else {
int err = PyDict_SetItem(slots, name, value);
+ Py_DECREF(name);
Py_DECREF(value);
if (err) {
goto error;
--
Repository URL: https://hg.python.org/cpython
More information about the Python-checkins
mailing list