Mirror
/
cpython
mirror of https://github.com/python/cpython
4
1
Fork 0
Code Issues Releases Wiki Activity

gh-92112: Fix crash triggered by an evil custom `mro()` (#92113)

This commit is contained in:
Alexey Izbyshev 2022-05-06 07:01:15 +03:00 committed by GitHub
parent adcb6a6055
commit 85354ed78c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 29 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
Lib/test/test_descr.py
View File

@ -5784,6 +5784,23 @@ class MroTest(unittest.TestCase):
class A(metaclass=M):
pass
def test_disappearing_custom_mro(self):
"""
gh-92112: A custom mro() returning a result conflicting with
__bases__ and deleting itself caused a double free.
"""
class B:
pass
class M(DebugHelperMeta):
def mro(cls):
del M.mro
return (B,)
with self.assertRaises(TypeError):
class A(metaclass=M):
pass
if __name__ == "__main__":
unittest.main()

1
Misc/NEWS.d/next/Core and Builtins/2022-05-01-10-58-38.gh-issue-92112.lLJemu.rst Normal file
View File

@ -0,0 +1 @@
Fix crash triggered by an evil custom ``mro()`` on a metaclass.

20
Objects/typeobject.c
View File

@ -345,22 +345,26 @@ type_mro_modified(PyTypeObject *type, PyObject *bases) {
Py_ssize_t i, n;
int custom = !Py_IS_TYPE(type, &PyType_Type);
int unbound;
PyObject *mro_meth = NULL;
PyObject *type_mro_meth = NULL;
if (custom) {
PyObject *mro_meth, *type_mro_meth;
mro_meth = lookup_maybe_method(
(PyObject *)type, &_Py_ID(mro), &unbound);
if (mro_meth == NULL)
if (mro_meth == NULL) {
goto clear;
}
type_mro_meth = lookup_maybe_method(
(PyObject *)&PyType_Type, &_Py_ID(mro), &unbound);
if (type_mro_meth == NULL)
if (type_mro_meth == NULL) {
Py_DECREF(mro_meth);
goto clear;
if (mro_meth != type_mro_meth)
}
int custom_mro = (mro_meth != type_mro_meth);
Py_DECREF(mro_meth);
Py_DECREF(type_mro_meth);
if (custom_mro) {
goto clear;
Py_XDECREF(mro_meth);
Py_XDECREF(type_mro_meth);
}
}
n = PyTuple_GET_SIZE(bases);
for (i = 0; i < n; i++) {
@ -373,8 +377,6 @@ type_mro_modified(PyTypeObject *type, PyObject *bases) {
}
return;
clear:
Py_XDECREF(mro_meth);
Py_XDECREF(type_mro_meth);
type->tp_flags &= ~Py_TPFLAGS_VALID_VERSION_TAG;
type->tp_version_tag = 0; /* 0 is not a valid version tag */
}