diff --git a/Lib/json/tests/test_dump.py b/Lib/json/tests/test_dump.py index 9a7c8ccdd0b..cd92569d98a 100644 --- a/Lib/json/tests/test_dump.py +++ b/Lib/json/tests/test_dump.py @@ -19,5 +19,14 @@ class TestDump(object): {2: 3.0, 4.0: 5L, False: 1, 6L: True}, sort_keys=True), '{"false": 1, "2": 3.0, "4.0": 5, "6": true}') + # Issue 16228: Crash on encoding resized list + def test_encode_mutated(self): + a = [object()] * 10 + def crasher(obj): + del a[-1] + self.assertEqual(self.dumps(a, default=crasher), + '[null, null, null, null, null]') + + class TestPyDump(TestDump, PyTest): pass class TestCDump(TestDump, CTest): pass diff --git a/Misc/NEWS b/Misc/NEWS index 43f1a8f2610..3c9ffc0bce0 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -130,6 +130,9 @@ Core and Builtins Library ------- +- Issue #16228: Fix a crash in the json module where a list changes size + while it is being encoded. Patch by Serhiy Storchaka. + - Issue #14897: Enhance error messages of struct.pack and struct.pack_into. Patch by Matti Mäki. diff --git a/Modules/_json.c b/Modules/_json.c index e8a288bd7dd..13f58163fe9 100644 --- a/Modules/_json.c +++ b/Modules/_json.c @@ -2224,8 +2224,6 @@ encoder_listencode_list(PyEncoderObject *s, PyObject *rval, PyObject *seq, Py_ss static PyObject *empty_array = NULL; PyObject *ident = NULL; PyObject *s_fast = NULL; - Py_ssize_t num_items; - PyObject **seq_items; Py_ssize_t i; if (open_array == NULL || close_array == NULL || empty_array == NULL) { @@ -2239,8 +2237,7 @@ encoder_listencode_list(PyEncoderObject *s, PyObject *rval, PyObject *seq, Py_ss s_fast = PySequence_Fast(seq, "_iterencode_list needs a sequence"); if (s_fast == NULL) return -1; - num_items = PySequence_Fast_GET_SIZE(s_fast); - if (num_items == 0) { + if (PySequence_Fast_GET_SIZE(s_fast) == 0) { Py_DECREF(s_fast); return PyList_Append(rval, empty_array); } @@ -2261,7 +2258,6 @@ encoder_listencode_list(PyEncoderObject *s, PyObject *rval, PyObject *seq, Py_ss } } - seq_items = PySequence_Fast_ITEMS(s_fast); if (PyList_Append(rval, open_array)) goto bail; if (s->indent != Py_None) { @@ -2273,8 +2269,8 @@ encoder_listencode_list(PyEncoderObject *s, PyObject *rval, PyObject *seq, Py_ss buf += newline_indent */ } - for (i = 0; i < num_items; i++) { - PyObject *obj = seq_items[i]; + for (i = 0; i < PySequence_Fast_GET_SIZE(s_fast); i++) { + PyObject *obj = PySequence_Fast_GET_ITEM(s_fast, i); if (i) { if (PyList_Append(rval, s->item_separator)) goto bail;