traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Issue #25725: Fixed a reference leak in pickle.loads() when unpickling 

invalid data including tuple instructions.
This commit is contained in:
Serhiy Storchaka 2015-11-25 15:01:53 +02:00
parent 4f44d53770
commit a49de6be36
2 changed files with 11 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Misc/NEWS
View File

@ -106,6 +106,9 @@ Core and Builtins
Library
-------
- Issue #25725: Fixed a reference leak in pickle.loads() when unpickling
invalid data including tuple instructions.
- Issue #25663: In the Readline completer, avoid listing duplicate global
names, and search the global namespace before searching builtins.

27
Modules/_pickle.c
View File

@ -4915,15 +4915,14 @@ load_counted_binunicode(UnpicklerObject *self, int nbytes)
}
static int
load_tuple(UnpicklerObject *self)
load_counted_tuple(UnpicklerObject *self, int len)
{
PyObject *tuple;
Py_ssize_t i;
if ((i = marker(self)) < 0)
return -1;
if (Py_SIZE(self->stack) < len)
return stack_underflow();
tuple = Pdata_poptuple(self->stack, i);
tuple = Pdata_poptuple(self->stack, Py_SIZE(self->stack) - len);
if (tuple == NULL)
return -1;
PDATA_PUSH(self->stack, tuple, -1);
@ -4931,24 +4930,14 @@ load_tuple(UnpicklerObject *self)
}
static int
load_counted_tuple(UnpicklerObject *self, int len)
load_tuple(UnpicklerObject *self)
{
PyObject *tuple;
Py_ssize_t i;
tuple = PyTuple_New(len);
if (tuple == NULL)
if ((i = marker(self)) < 0)
return -1;
while (--len >= 0) {
PyObject *item;
PDATA_POP(self->stack, item);
if (item == NULL)
return -1;
PyTuple_SET_ITEM(tuple, len, item);
}
PDATA_PUSH(self->stack, tuple, -1);
return 0;
return load_counted_tuple(self, Py_SIZE(self->stack) - i);
}
static int