Mirror
/
cpython
mirror of https://github.com/python/cpython
4
1
Fork 0
Code Issues Releases Wiki Activity

gh-115874: Don't use module state in teedataobject tp_dealloc (#116204) 

Co-authored-by: Brandt Bucher <brandtbucher@microsoft.com>
This commit is contained in:
Erlend E. Aasland 2024-03-18 13:24:24 +01:00 committed by GitHub
parent cd2ed91780
commit e2fcaf19d3
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
Lib/test/test_itertools.py
View File

@ -1,7 +1,7 @@
import doctest
import unittest
from test import support
from test.support import threading_helper
from test.support import threading_helper, script_helper
from itertools import *
import weakref
from decimal import Decimal
@ -1699,6 +1699,14 @@ class TestBasicOps(unittest.TestCase):
self.pickletest(proto, a, compare=ans)
self.pickletest(proto, b, compare=ans)
def test_tee_dealloc_segfault(self):
# gh-115874: segfaults when accessing module state in tp_dealloc.
script = (
"import typing, copyreg, itertools; "
"copyreg.buggy_tee = itertools.tee(())"
)
script_helper.assert_python_ok("-c", script)
# Issue 13454: Crash when deleting backward iterator from tee()
def test_tee_del_backward(self):
forward, backward = tee(repeat(None, 20000000))

8
Modules/itertoolsmodule.c
View File

@ -815,10 +815,9 @@ teedataobject_traverse(teedataobject *tdo, visitproc visit, void * arg)
}
static void
teedataobject_safe_decref(PyObject *obj, PyTypeObject *tdo_type)
teedataobject_safe_decref(PyObject *obj)
{
while (obj && Py_IS_TYPE(obj, tdo_type) &&
Py_REFCNT(obj) == 1) {
while (obj && Py_REFCNT(obj) == 1) {
PyObject *nextlink = ((teedataobject *)obj)->nextlink;
((teedataobject *)obj)->nextlink = NULL;
Py_SETREF(obj, nextlink);
@ -837,8 +836,7 @@ teedataobject_clear(teedataobject *tdo)
Py_CLEAR(tdo->values[i]);
tmp = tdo->nextlink;
tdo->nextlink = NULL;
itertools_state *state = get_module_state_by_cls(Py_TYPE(tdo));
teedataobject_safe_decref(tmp, state->teedataobject_type);
teedataobject_safe_decref(tmp);
return 0;
}