traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Issue #6083: Fix multiple segmentation faults occured when PyArg_ParseTuple 

parses nested mutating sequence.
This commit is contained in:
Serhiy Storchaka 2013-02-04 12:47:24 +02:00
parent 64359d203e
commit 19c4e0df29
7 changed files with 118 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
Lib/ctypes/test/test_returnfuncptrs.py
View File

@ -33,5 +33,33 @@ class ReturnFuncPtrTestCase(unittest.TestCase):
self.assertRaises(ArgumentError, strchr, b"abcdef", 3.0)
self.assertRaises(TypeError, strchr, b"abcdef")
def test_from_dll(self):
dll = CDLL(_ctypes_test.__file__)
# _CFuncPtr instances are now callable with a tuple argument
# which denotes a function name and a dll:
strchr = CFUNCTYPE(c_char_p, c_char_p, c_char)(("strchr", dll))
self.assertTrue(strchr(b"abcdef", b"b"), "bcdef")
self.assertEqual(strchr(b"abcdef", b"x"), None)
self.assertRaises(ArgumentError, strchr, b"abcdef", 3.0)
self.assertRaises(TypeError, strchr, b"abcdef")
# Issue 6083: Reference counting bug
def test_test_from_dll_refcount(self):
class BadSequence(tuple):
def __getitem__(self, key):
if key == 0:
return "strchr"
if key == 1:
return CDLL(_ctypes_test.__file__)
raise IndexError
# _CFuncPtr instances are now callable with a tuple argument
# which denotes a function name and a dll:
strchr = CFUNCTYPE(c_char_p, c_char_p, c_char)(BadSequence(("strchr", CDLL(_ctypes_test.__file__))))
self.assertTrue(strchr(b"abcdef", b"b"), "bcdef")
self.assertEqual(strchr(b"abcdef", b"x"), None)
self.assertRaises(ArgumentError, strchr, b"abcdef", 3.0)
self.assertRaises(TypeError, strchr, b"abcdef")
if __name__ == "__main__":
unittest.main()

20
Lib/test/test_functools.py
View File

@ -179,6 +179,25 @@ class TestPartial(unittest.TestCase):
f_copy = pickle.loads(pickle.dumps(f))
self.assertEqual(signature(f), signature(f_copy))
# Issue 6083: Reference counting bug
def test_setstate_refcount(self):
class BadSequence:
def __len__(self):
return 4
def __getitem__(self, key):
if key == 0:
return max
elif key == 1:
return tuple(range(1000000))
elif key in (2, 3):
return {}
raise IndexError
f = self.thetype(object)
self.assertRaisesRegex(SystemError,
"new style getargs format but argument is not a tuple",
f.__setstate__, BadSequence())
class PartialSubclass(functools.partial):
pass
@ -195,6 +214,7 @@ class TestPythonPartial(TestPartial):
# the python version isn't picklable
def test_pickle(self): pass
def test_setstate_refcount(self): pass
class TestUpdateWrapper(unittest.TestCase):

17
Lib/test/test_resource.py
View File

@ -107,6 +107,23 @@ class ResourceTest(unittest.TestCase):
except (ValueError, AttributeError):
pass
# Issue 6083: Reference counting bug
def test_setrusage_refcount(self):
try:
limits = resource.getrlimit(resource.RLIMIT_CPU)
except AttributeError:
pass
else:
class BadSequence:
def __len__(self):
return 2
def __getitem__(self, key):
if key in (0, 1):
return len(tuple(range(1000000)))
raise IndexError
resource.setrlimit(resource.RLIMIT_CPU, BadSequence())
def test_main(verbose=None):
support.run_unittest(ResourceTest)

3
Misc/NEWS
View File

@ -212,6 +212,9 @@ Core and Builtins
Library
-------
- Issue #6083: Fix multiple segmentation faults occured when PyArg_ParseTuple
parses nested mutating sequence.
- Issue #17106: Fix a segmentation fault in io.TextIOWrapper when an underlying
stream or a decoder produces data of an unexpected type (i.e. when
io.TextIOWrapper initialized with text stream or use bytes-to-bytes codec).

26
Modules/_ctypes/_ctypes.c
View File

@ -3184,23 +3184,37 @@ PyCFuncPtr_FromDll(PyTypeObject *type, PyObject *args, PyObject *kwds)
{
char *name;
int (* address)(void);
PyObject *ftuple;
PyObject *dll;
PyObject *obj;
PyCFuncPtrObject *self;
void *handle;
PyObject *paramflags = NULL;
if (!PyArg_ParseTuple(args, "(O&O)|O", _get_name, &name, &dll, &paramflags))
if (!PyArg_ParseTuple(args, "O|O", &ftuple, &paramflags))
return NULL;
if (paramflags == Py_None)
paramflags = NULL;
obj = PyObject_GetAttrString(dll, "_handle");
if (!obj)
ftuple = PySequence_Tuple(ftuple);
if (!ftuple)
/* Here ftuple is a borrowed reference */
return NULL;
if (!PyArg_ParseTuple(ftuple, "O&O", _get_name, &name, &dll)) {
Py_DECREF(ftuple);
return NULL;
}
obj = PyObject_GetAttrString(dll, "_handle");
if (!obj) {
Py_DECREF(ftuple);
return NULL;
}
if (!PyLong_Check(obj)) {
PyErr_SetString(PyExc_TypeError,
"the _handle attribute of the second argument must be an integer");
Py_DECREF(ftuple);
Py_DECREF(obj);
return NULL;
}
@ -3209,6 +3223,7 @@ PyCFuncPtr_FromDll(PyTypeObject *type, PyObject *args, PyObject *kwds)
if (PyErr_Occurred()) {
PyErr_SetString(PyExc_ValueError,
"could not convert the _handle attribute to a pointer");
Py_DECREF(ftuple);
return NULL;
}
@ -3223,6 +3238,7 @@ PyCFuncPtr_FromDll(PyTypeObject *type, PyObject *args, PyObject *kwds)
PyErr_Format(PyExc_AttributeError,
"function ordinal %d not found",
(WORD)(size_t)name);
Py_DECREF(ftuple);
return NULL;
}
#else
@ -3236,9 +3252,12 @@ PyCFuncPtr_FromDll(PyTypeObject *type, PyObject *args, PyObject *kwds)
#else
PyErr_SetString(PyExc_AttributeError, ctypes_dlerror());
#endif
Py_DECREF(ftuple);
return NULL;
}
#endif
Py_INCREF(dll); /* for KeepRef */
Py_DECREF(ftuple);
if (!_validate_paramflags(type, paramflags))
return NULL;
@ -3251,7 +3270,6 @@ PyCFuncPtr_FromDll(PyTypeObject *type, PyObject *args, PyObject *kwds)
*(void **)self->b_ptr = address;
Py_INCREF((PyObject *)dll); /* for KeepRef */
if (-1 == KeepRef((CDataObject *)self, 0, dll)) {
Py_DECREF((PyObject *)self);
return NULL;

6
Modules/_functoolsmodule.c
View File

@ -254,10 +254,10 @@ partial_reduce(partialobject *pto, PyObject *unused)
}
static PyObject *
partial_setstate(partialobject *pto, PyObject *args)
partial_setstate(partialobject *pto, PyObject *state)
{
PyObject *fn, *fnargs, *kw, *dict;
if (!PyArg_ParseTuple(args, "(OOOO):__setstate__",
if (!PyArg_ParseTuple(state, "OOOO",
&fn, &fnargs, &kw, &dict))
return NULL;
Py_XDECREF(pto->fn);
@ -281,7 +281,7 @@ partial_setstate(partialobject *pto, PyObject *args)
static PyMethodDef partial_methods[] = {
{"__reduce__", (PyCFunction)partial_reduce, METH_NOARGS},
{"__setstate__", (PyCFunction)partial_setstate, METH_VARARGS},
{"__setstate__", (PyCFunction)partial_setstate, METH_O},
{NULL, NULL} /* sentinel */
};

33
Modules/resource.c
View File

@ -144,10 +144,9 @@ resource_setrlimit(PyObject *self, PyObject *args)
{
struct rlimit rl;
int resource;
PyObject *curobj, *maxobj;
PyObject *limits, *curobj, *maxobj;
if (!PyArg_ParseTuple(args, "i(OO):setrlimit",
&resource, &curobj, &maxobj))
if (!PyArg_ParseTuple(args, "iO:setrlimit", &resource, &limits))
return NULL;
if (resource < 0 || resource >= RLIM_NLIMITS) {
@ -156,21 +155,34 @@ resource_setrlimit(PyObject *self, PyObject *args)
return NULL;
}
limits = PySequence_Tuple(limits);
if (!limits)
/* Here limits is a borrowed reference */
return NULL;
if (PyTuple_GET_SIZE(limits) != 2) {
PyErr_SetString(PyExc_ValueError,
"expected a tuple of 2 integers");
goto error;
}
curobj = PyTuple_GET_ITEM(limits, 0);
maxobj = PyTuple_GET_ITEM(limits, 1);
#if !defined(HAVE_LARGEFILE_SUPPORT)
rl.rlim_cur = PyLong_AsLong(curobj);
if (rl.rlim_cur == (rlim_t)-1 && PyErr_Occurred())
return NULL;
goto error;
rl.rlim_max = PyLong_AsLong(maxobj);
if (rl.rlim_max == (rlim_t)-1 && PyErr_Occurred())
return NULL;
goto error;
#else
/* The limits are probably bigger than a long */
rl.rlim_cur = PyLong_AsLongLong(curobj);
if (rl.rlim_cur == (rlim_t)-1 && PyErr_Occurred())
return NULL;
goto error;
rl.rlim_max = PyLong_AsLongLong(maxobj);
if (rl.rlim_max == (rlim_t)-1 && PyErr_Occurred())
return NULL;
goto error;
#endif
rl.rlim_cur = rl.rlim_cur & RLIM_INFINITY;
@ -184,10 +196,15 @@ resource_setrlimit(PyObject *self, PyObject *args)
"not allowed to raise maximum limit");
else
PyErr_SetFromErrno(ResourceError);
return NULL;
goto error;
}
Py_DECREF(limits);
Py_INCREF(Py_None);
return Py_None;
error:
Py_DECREF(limits);
return NULL;
}
static PyObject *