traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

bpo-35961: Fix a crash in slice_richcompare() (GH-11830) 

Fix a crash in slice_richcompare(): use strong references rather than
stolen references for the two temporary internal tuples.

The crash (or assertion error) occurred if a garbage collection
occurred during slice_richcompare(), especially while calling
PyObject_RichCompare(t1, t2, op).
(cherry picked from commit dcb68f47f7)

Co-authored-by: Victor Stinner <vstinner@redhat.com>
This commit is contained in:
Miss Islington (bot) 2019-02-13 03:49:34 -08:00 committed by GitHub
parent 00cc0fe177
commit a78251e2d6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 16 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Misc/NEWS.d/next/Core and Builtins/2019-02-12-20-16-34.bpo-35961.7f7Sne.rst Normal file
View File

@ -0,0 +1,2 @@
Fix a crash in slice_richcompare(): use strong references rather than stolen
references for the two temporary internal tuples.

38
Objects/sliceobject.c
View File

@ -564,14 +564,11 @@ static PyMethodDef slice_methods[] = {
static PyObject *
slice_richcompare(PyObject *v, PyObject *w, int op)
{
PyObject *t1;
PyObject *t2;
PyObject *res;
if (!PySlice_Check(v) || !PySlice_Check(w))
Py_RETURN_NOTIMPLEMENTED;
if (v == w) {
PyObject *res;
/* XXX Do we really need this shortcut?
There's a unit test for it, but is that fair? */
switch (op) {
@ -588,34 +585,27 @@ slice_richcompare(PyObject *v, PyObject *w, int op)
return res;
}
t1 = PyTuple_New(3);
if (t1 == NULL)
PyObject *t1 = PyTuple_Pack(3,
((PySliceObject *)v)->start,
((PySliceObject *)v)->stop,
((PySliceObject *)v)->step);
if (t1 == NULL) {
return NULL;
t2 = PyTuple_New(3);
}
PyObject *t2 = PyTuple_Pack(3,
((PySliceObject *)w)->start,
((PySliceObject *)w)->stop,
((PySliceObject *)w)->step);
if (t2 == NULL) {
Py_DECREF(t1);
return NULL;
}
PyTuple_SET_ITEM(t1, 0, ((PySliceObject *)v)->start);
PyTuple_SET_ITEM(t1, 1, ((PySliceObject *)v)->stop);
PyTuple_SET_ITEM(t1, 2, ((PySliceObject *)v)->step);
PyTuple_SET_ITEM(t2, 0, ((PySliceObject *)w)->start);
PyTuple_SET_ITEM(t2, 1, ((PySliceObject *)w)->stop);
PyTuple_SET_ITEM(t2, 2, ((PySliceObject *)w)->step);
res = PyObject_RichCompare(t1, t2, op);
PyTuple_SET_ITEM(t1, 0, NULL);
PyTuple_SET_ITEM(t1, 1, NULL);
PyTuple_SET_ITEM(t1, 2, NULL);
PyTuple_SET_ITEM(t2, 0, NULL);
PyTuple_SET_ITEM(t2, 1, NULL);
PyTuple_SET_ITEM(t2, 2, NULL);
PyObject *res = PyObject_RichCompare(t1, t2, op);
Py_DECREF(t1);
Py_DECREF(t2);
return res;
}