mirror of https://github.com/python/cpython
bpo-27946: Fix possible crash in ElementTree.Element (GH-29915)
Getting an attribute via attrib.get() simultaneously with replacing the attrib dict can lead to access to deallocated dict.
This commit is contained in:
parent
f42a06ba27
commit
d15cdb2f32
|
@ -169,6 +169,18 @@ class MiscTests(unittest.TestCase):
|
|||
del parser
|
||||
support.gc_collect()
|
||||
|
||||
def test_dict_disappearing_during_get_item(self):
|
||||
# test fix for seg fault reported in issue 27946
|
||||
class X:
|
||||
def __hash__(self):
|
||||
e.attrib = {} # this frees e->extra->attrib
|
||||
[{i: i} for i in range(1000)] # exhaust the dict keys cache
|
||||
return 13
|
||||
|
||||
e = cET.Element("elem", {1: 2})
|
||||
r = e.get(X())
|
||||
self.assertIsNone(r)
|
||||
|
||||
|
||||
@unittest.skipUnless(cET, 'requires _elementtree')
|
||||
class TestAliasWorking(unittest.TestCase):
|
||||
|
|
|
@ -0,0 +1,3 @@
|
|||
Fix possible crash when getting an attribute of
|
||||
class:`xml.etree.ElementTree.Element` simultaneously with
|
||||
replacing the ``attrib`` dict.
|
|
@ -1393,22 +1393,19 @@ _elementtree_Element_get_impl(ElementObject *self, PyObject *key,
|
|||
PyObject *default_value)
|
||||
/*[clinic end generated code: output=523c614142595d75 input=ee153bbf8cdb246e]*/
|
||||
{
|
||||
PyObject* value;
|
||||
|
||||
if (!self->extra || !self->extra->attrib)
|
||||
value = default_value;
|
||||
else {
|
||||
value = PyDict_GetItemWithError(self->extra->attrib, key);
|
||||
if (!value) {
|
||||
if (PyErr_Occurred()) {
|
||||
return NULL;
|
||||
}
|
||||
value = default_value;
|
||||
if (self->extra && self->extra->attrib) {
|
||||
PyObject *attrib = self->extra->attrib;
|
||||
Py_INCREF(attrib);
|
||||
PyObject *value = PyDict_GetItemWithError(attrib, key);
|
||||
Py_XINCREF(value);
|
||||
Py_DECREF(attrib);
|
||||
if (value != NULL || PyErr_Occurred()) {
|
||||
return value;
|
||||
}
|
||||
}
|
||||
|
||||
Py_INCREF(value);
|
||||
return value;
|
||||
Py_INCREF(default_value);
|
||||
return default_value;
|
||||
}
|
||||
|
||||
static PyObject *
|
||||
|
|
Loading…
Reference in New Issue