traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

bpo-29438: fixed use-after-free in key sharing dict (#39)

This commit is contained in:
INADA Naoki 2017-02-13 09:19:05 +09:00 committed by GitHub
parent f66c81ff49
commit 89ddffbe9d
2 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Misc/NEWS
View File

@ -10,6 +10,8 @@ What's New in Python 3.6.1 release candidate 1?
Core and Builtins
-----------------
- bpo-29438: Fixed use-after-free problem in key sharing dict.
- Issue #29319: Prevent RunMainFromImporter overwriting sys.path[0].
- Issue #29337: Fixed possible BytesWarning when compare the code objects.

10
Objects/dictobject.c
View File

@ -4376,15 +4376,19 @@ _PyObjectDict_SetItem(PyTypeObject *tp, PyObject **dictptr,
}
if (value == NULL) {
res = PyDict_DelItem(dict, key);
if (cached != ((PyDictObject *)dict)->ma_keys) {
// Since key sharing dict doesn't allow deletion, PyDict_DelItem()
// always converts dict to combined form.
if ((cached = CACHED_KEYS(tp)) != NULL) {
CACHED_KEYS(tp) = NULL;
DK_DECREF(cached);
}
}
else {
int was_shared = cached == ((PyDictObject *)dict)->ma_keys;
int was_shared = (cached == ((PyDictObject *)dict)->ma_keys);
res = PyDict_SetItem(dict, key, value);
if (was_shared && cached != ((PyDictObject *)dict)->ma_keys) {
if (was_shared &&
(cached = CACHED_KEYS(tp)) != NULL &&
cached != ((PyDictObject *)dict)->ma_keys) {
/* PyDict_SetItem() may call dictresize and convert split table
* into combined table. In such case, convert it to split
* table again and update type's shared key only when this is