Mirror
/
cpython
mirror of https://github.com/python/cpython
4
1
Fork 0
Code Issues Releases Wiki Activity

bpo-25750: fix refcounts in type_getattro() (GH-6118) 

When calling tp_descr_get(self, obj, type), make sure that
we own a strong reference to "self".
This commit is contained in:
jdemeyer 2018-09-07 09:37:00 +02:00 committed by Victor Stinner
parent 593bb30e82
commit 8f735485ac
2 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Misc/NEWS.d/next/Core and Builtins/2018-03-14-21-42-17.bpo-25750.lxgkQz.rst Normal file
View File

@ -0,0 +1,2 @@
Fix rare Python crash due to bad refcounting in ``type_getattro()`` if a
descriptor deletes itself from the class. Patch by Jeroen Demeyer.

17
Objects/typeobject.c
View File

@ -3145,6 +3145,7 @@ type_getattro(PyTypeObject *type, PyObject *name)
PyTypeObject *metatype = Py_TYPE(type); PyTypeObject *metatype = Py_TYPE(type);
PyObject *meta_attribute, *attribute; PyObject *meta_attribute, *attribute;
descrgetfunc meta_get; descrgetfunc meta_get;
PyObject* res;
if (!PyUnicode_Check(name)) { if (!PyUnicode_Check(name)) {
PyErr_Format(PyExc_TypeError, PyErr_Format(PyExc_TypeError,
@ -3166,6 +3167,7 @@ type_getattro(PyTypeObject *type, PyObject *name)
meta_attribute = _PyType_Lookup(metatype, name); meta_attribute = _PyType_Lookup(metatype, name);
if (meta_attribute != NULL) { if (meta_attribute != NULL) {
Py_INCREF(meta_attribute);
meta_get = Py_TYPE(meta_attribute)->tp_descr_get; meta_get = Py_TYPE(meta_attribute)->tp_descr_get;
if (meta_get != NULL && PyDescr_IsData(meta_attribute)) { if (meta_get != NULL && PyDescr_IsData(meta_attribute)) {
@ -3173,10 +3175,11 @@ type_getattro(PyTypeObject *type, PyObject *name)
* writes. Assume the attribute is not overridden in * writes. Assume the attribute is not overridden in
* type's tp_dict (and bases): call the descriptor now. * type's tp_dict (and bases): call the descriptor now.
*/ */
return meta_get(meta_attribute, (PyObject *)type, res = meta_get(meta_attribute, (PyObject *)type,
(PyObject *)metatype); (PyObject *)metatype);
Py_DECREF(meta_attribute);
return res;
} }
Py_INCREF(meta_attribute);
} }
/* No data descriptor found on metatype. Look in tp_dict of this /* No data descriptor found on metatype. Look in tp_dict of this
@ -3184,6 +3187,7 @@ type_getattro(PyTypeObject *type, PyObject *name)
attribute = _PyType_Lookup(type, name); attribute = _PyType_Lookup(type, name);
if (attribute != NULL) { if (attribute != NULL) {
/* Implement descriptor functionality, if any */ /* Implement descriptor functionality, if any */
Py_INCREF(attribute);
descrgetfunc local_get = Py_TYPE(attribute)->tp_descr_get; descrgetfunc local_get = Py_TYPE(attribute)->tp_descr_get;
Py_XDECREF(meta_attribute); Py_XDECREF(meta_attribute);
@ -3191,11 +3195,12 @@ type_getattro(PyTypeObject *type, PyObject *name)
if (local_get != NULL) { if (local_get != NULL) {
/* NULL 2nd argument indicates the descriptor was /* NULL 2nd argument indicates the descriptor was
* found on the target object itself (or a base) */ * found on the target object itself (or a base) */
return local_get(attribute, (PyObject *)NULL, res = local_get(attribute, (PyObject *)NULL,
(PyObject *)type); (PyObject *)type);
Py_DECREF(attribute);
return res;
} }
Py_INCREF(attribute);
return attribute; return attribute;
} }