Mirror
/
cpython
mirror of https://github.com/python/cpython
4
1
Fork 0
Code Issues Releases Wiki Activity

Issue #18328: Reorder ops in PyThreadState_Delete*() functions. Now the 

tstate is first removed from TLS and then deallocated.
CID 1019639 (#1 of 1): Use after free (USE_AFTER_FREE)
 use_after_free: Using freed pointer tstate.
This commit is contained in:
Christian Heimes 2013-07-01 23:43:09 +02:00
parent 3126a3d156 b9dbc7d6e1
commit 1d5b933504
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Misc/NEWS
View File

@ -10,6 +10,9 @@ What's New in Python 3.4.0 Alpha 1?
Core and Builtins Core and Builtins
----------------- -----------------
- Issue #18328: Reorder ops in PyThreadState_Delete*() functions. Now the
tstate is first removed from TLS and then deallocated.
- Issue #13483: Use VirtualAlloc in obmalloc on Windows. - Issue #13483: Use VirtualAlloc in obmalloc on Windows.
- Issue #18184: PyUnicode_FromFormat() and PyUnicode_FromFormatV() now raise - Issue #18184: PyUnicode_FromFormat() and PyUnicode_FromFormatV() now raise

4
Python/pystate.c
View File

@ -374,11 +374,11 @@ PyThreadState_Delete(PyThreadState *tstate)
{ {
if (tstate == _Py_atomic_load_relaxed(&_PyThreadState_Current)) if (tstate == _Py_atomic_load_relaxed(&_PyThreadState_Current))
Py_FatalError("PyThreadState_Delete: tstate is still current"); Py_FatalError("PyThreadState_Delete: tstate is still current");
tstate_delete_common(tstate);
#ifdef WITH_THREAD #ifdef WITH_THREAD
if (autoInterpreterState && PyThread_get_key_value(autoTLSkey) == tstate) if (autoInterpreterState && PyThread_get_key_value(autoTLSkey) == tstate)
PyThread_delete_key_value(autoTLSkey); PyThread_delete_key_value(autoTLSkey);
#endif /* WITH_THREAD */ #endif /* WITH_THREAD */
tstate_delete_common(tstate);
} }
@ -392,9 +392,9 @@ PyThreadState_DeleteCurrent()
Py_FatalError( Py_FatalError(
"PyThreadState_DeleteCurrent: no current tstate"); "PyThreadState_DeleteCurrent: no current tstate");
_Py_atomic_store_relaxed(&_PyThreadState_Current, NULL); _Py_atomic_store_relaxed(&_PyThreadState_Current, NULL);
tstate_delete_common(tstate);
if (autoInterpreterState && PyThread_get_key_value(autoTLSkey) == tstate) if (autoInterpreterState && PyThread_get_key_value(autoTLSkey) == tstate)
PyThread_delete_key_value(autoTLSkey); PyThread_delete_key_value(autoTLSkey);
tstate_delete_common(tstate);
PyEval_ReleaseLock(); PyEval_ReleaseLock();
} }
#endif /* WITH_THREAD */ #endif /* WITH_THREAD */