From 19c4e0df29234355074fe7ec67857f0a0b7e0a18 Mon Sep 17 00:00:00 2001 From: Serhiy Storchaka Date: Mon, 4 Feb 2013 12:47:24 +0200 Subject: [PATCH] Issue #6083: Fix multiple segmentation faults occured when PyArg_ParseTuple parses nested mutating sequence. --- Lib/ctypes/test/test_returnfuncptrs.py | 28 ++++++++++++++++++++++ Lib/test/test_functools.py | 20 ++++++++++++++++ Lib/test/test_resource.py | 17 +++++++++++++ Misc/NEWS | 3 +++ Modules/_ctypes/_ctypes.c | 26 ++++++++++++++++---- Modules/_functoolsmodule.c | 6 ++--- Modules/resource.c | 33 +++++++++++++++++++------- 7 files changed, 118 insertions(+), 15 deletions(-) diff --git a/Lib/ctypes/test/test_returnfuncptrs.py b/Lib/ctypes/test/test_returnfuncptrs.py index af1caddaabf..21cb843fed3 100644 --- a/Lib/ctypes/test/test_returnfuncptrs.py +++ b/Lib/ctypes/test/test_returnfuncptrs.py @@ -33,5 +33,33 @@ class ReturnFuncPtrTestCase(unittest.TestCase): self.assertRaises(ArgumentError, strchr, b"abcdef", 3.0) self.assertRaises(TypeError, strchr, b"abcdef") + def test_from_dll(self): + dll = CDLL(_ctypes_test.__file__) + # _CFuncPtr instances are now callable with a tuple argument + # which denotes a function name and a dll: + strchr = CFUNCTYPE(c_char_p, c_char_p, c_char)(("strchr", dll)) + self.assertTrue(strchr(b"abcdef", b"b"), "bcdef") + self.assertEqual(strchr(b"abcdef", b"x"), None) + self.assertRaises(ArgumentError, strchr, b"abcdef", 3.0) + self.assertRaises(TypeError, strchr, b"abcdef") + + # Issue 6083: Reference counting bug + def test_test_from_dll_refcount(self): + class BadSequence(tuple): + def __getitem__(self, key): + if key == 0: + return "strchr" + if key == 1: + return CDLL(_ctypes_test.__file__) + raise IndexError + + # _CFuncPtr instances are now callable with a tuple argument + # which denotes a function name and a dll: + strchr = CFUNCTYPE(c_char_p, c_char_p, c_char)(BadSequence(("strchr", CDLL(_ctypes_test.__file__)))) + self.assertTrue(strchr(b"abcdef", b"b"), "bcdef") + self.assertEqual(strchr(b"abcdef", b"x"), None) + self.assertRaises(ArgumentError, strchr, b"abcdef", 3.0) + self.assertRaises(TypeError, strchr, b"abcdef") + if __name__ == "__main__": unittest.main() diff --git a/Lib/test/test_functools.py b/Lib/test/test_functools.py index 4708381f3f9..11e6e844204 100644 --- a/Lib/test/test_functools.py +++ b/Lib/test/test_functools.py @@ -179,6 +179,25 @@ class TestPartial(unittest.TestCase): f_copy = pickle.loads(pickle.dumps(f)) self.assertEqual(signature(f), signature(f_copy)) + # Issue 6083: Reference counting bug + def test_setstate_refcount(self): + class BadSequence: + def __len__(self): + return 4 + def __getitem__(self, key): + if key == 0: + return max + elif key == 1: + return tuple(range(1000000)) + elif key in (2, 3): + return {} + raise IndexError + + f = self.thetype(object) + self.assertRaisesRegex(SystemError, + "new style getargs format but argument is not a tuple", + f.__setstate__, BadSequence()) + class PartialSubclass(functools.partial): pass @@ -195,6 +214,7 @@ class TestPythonPartial(TestPartial): # the python version isn't picklable def test_pickle(self): pass + def test_setstate_refcount(self): pass class TestUpdateWrapper(unittest.TestCase): diff --git a/Lib/test/test_resource.py b/Lib/test/test_resource.py index 3c9b6207026..f3416b7b43e 100644 --- a/Lib/test/test_resource.py +++ b/Lib/test/test_resource.py @@ -107,6 +107,23 @@ class ResourceTest(unittest.TestCase): except (ValueError, AttributeError): pass + # Issue 6083: Reference counting bug + def test_setrusage_refcount(self): + try: + limits = resource.getrlimit(resource.RLIMIT_CPU) + except AttributeError: + pass + else: + class BadSequence: + def __len__(self): + return 2 + def __getitem__(self, key): + if key in (0, 1): + return len(tuple(range(1000000))) + raise IndexError + + resource.setrlimit(resource.RLIMIT_CPU, BadSequence()) + def test_main(verbose=None): support.run_unittest(ResourceTest) diff --git a/Misc/NEWS b/Misc/NEWS index 53b88ac03a7..c5a64c220f1 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -212,6 +212,9 @@ Core and Builtins Library ------- +- Issue #6083: Fix multiple segmentation faults occured when PyArg_ParseTuple + parses nested mutating sequence. + - Issue #17106: Fix a segmentation fault in io.TextIOWrapper when an underlying stream or a decoder produces data of an unexpected type (i.e. when io.TextIOWrapper initialized with text stream or use bytes-to-bytes codec). diff --git a/Modules/_ctypes/_ctypes.c b/Modules/_ctypes/_ctypes.c index 73ab2fdc422..e4e237ea84d 100644 --- a/Modules/_ctypes/_ctypes.c +++ b/Modules/_ctypes/_ctypes.c @@ -3184,23 +3184,37 @@ PyCFuncPtr_FromDll(PyTypeObject *type, PyObject *args, PyObject *kwds) { char *name; int (* address)(void); + PyObject *ftuple; PyObject *dll; PyObject *obj; PyCFuncPtrObject *self; void *handle; PyObject *paramflags = NULL; - if (!PyArg_ParseTuple(args, "(O&O)|O", _get_name, &name, &dll, ¶mflags)) + if (!PyArg_ParseTuple(args, "O|O", &ftuple, ¶mflags)) return NULL; if (paramflags == Py_None) paramflags = NULL; - obj = PyObject_GetAttrString(dll, "_handle"); - if (!obj) + ftuple = PySequence_Tuple(ftuple); + if (!ftuple) + /* Here ftuple is a borrowed reference */ return NULL; + + if (!PyArg_ParseTuple(ftuple, "O&O", _get_name, &name, &dll)) { + Py_DECREF(ftuple); + return NULL; + } + + obj = PyObject_GetAttrString(dll, "_handle"); + if (!obj) { + Py_DECREF(ftuple); + return NULL; + } if (!PyLong_Check(obj)) { PyErr_SetString(PyExc_TypeError, "the _handle attribute of the second argument must be an integer"); + Py_DECREF(ftuple); Py_DECREF(obj); return NULL; } @@ -3209,6 +3223,7 @@ PyCFuncPtr_FromDll(PyTypeObject *type, PyObject *args, PyObject *kwds) if (PyErr_Occurred()) { PyErr_SetString(PyExc_ValueError, "could not convert the _handle attribute to a pointer"); + Py_DECREF(ftuple); return NULL; } @@ -3223,6 +3238,7 @@ PyCFuncPtr_FromDll(PyTypeObject *type, PyObject *args, PyObject *kwds) PyErr_Format(PyExc_AttributeError, "function ordinal %d not found", (WORD)(size_t)name); + Py_DECREF(ftuple); return NULL; } #else @@ -3236,9 +3252,12 @@ PyCFuncPtr_FromDll(PyTypeObject *type, PyObject *args, PyObject *kwds) #else PyErr_SetString(PyExc_AttributeError, ctypes_dlerror()); #endif + Py_DECREF(ftuple); return NULL; } #endif + Py_INCREF(dll); /* for KeepRef */ + Py_DECREF(ftuple); if (!_validate_paramflags(type, paramflags)) return NULL; @@ -3251,7 +3270,6 @@ PyCFuncPtr_FromDll(PyTypeObject *type, PyObject *args, PyObject *kwds) *(void **)self->b_ptr = address; - Py_INCREF((PyObject *)dll); /* for KeepRef */ if (-1 == KeepRef((CDataObject *)self, 0, dll)) { Py_DECREF((PyObject *)self); return NULL; diff --git a/Modules/_functoolsmodule.c b/Modules/_functoolsmodule.c index d8a283bcec6..a0ea3ab8497 100644 --- a/Modules/_functoolsmodule.c +++ b/Modules/_functoolsmodule.c @@ -254,10 +254,10 @@ partial_reduce(partialobject *pto, PyObject *unused) } static PyObject * -partial_setstate(partialobject *pto, PyObject *args) +partial_setstate(partialobject *pto, PyObject *state) { PyObject *fn, *fnargs, *kw, *dict; - if (!PyArg_ParseTuple(args, "(OOOO):__setstate__", + if (!PyArg_ParseTuple(state, "OOOO", &fn, &fnargs, &kw, &dict)) return NULL; Py_XDECREF(pto->fn); @@ -281,7 +281,7 @@ partial_setstate(partialobject *pto, PyObject *args) static PyMethodDef partial_methods[] = { {"__reduce__", (PyCFunction)partial_reduce, METH_NOARGS}, - {"__setstate__", (PyCFunction)partial_setstate, METH_VARARGS}, + {"__setstate__", (PyCFunction)partial_setstate, METH_O}, {NULL, NULL} /* sentinel */ }; diff --git a/Modules/resource.c b/Modules/resource.c index 1875e483f9b..cadf9e6dff3 100644 --- a/Modules/resource.c +++ b/Modules/resource.c @@ -144,10 +144,9 @@ resource_setrlimit(PyObject *self, PyObject *args) { struct rlimit rl; int resource; - PyObject *curobj, *maxobj; + PyObject *limits, *curobj, *maxobj; - if (!PyArg_ParseTuple(args, "i(OO):setrlimit", - &resource, &curobj, &maxobj)) + if (!PyArg_ParseTuple(args, "iO:setrlimit", &resource, &limits)) return NULL; if (resource < 0 || resource >= RLIM_NLIMITS) { @@ -156,21 +155,34 @@ resource_setrlimit(PyObject *self, PyObject *args) return NULL; } + limits = PySequence_Tuple(limits); + if (!limits) + /* Here limits is a borrowed reference */ + return NULL; + + if (PyTuple_GET_SIZE(limits) != 2) { + PyErr_SetString(PyExc_ValueError, + "expected a tuple of 2 integers"); + goto error; + } + curobj = PyTuple_GET_ITEM(limits, 0); + maxobj = PyTuple_GET_ITEM(limits, 1); + #if !defined(HAVE_LARGEFILE_SUPPORT) rl.rlim_cur = PyLong_AsLong(curobj); if (rl.rlim_cur == (rlim_t)-1 && PyErr_Occurred()) - return NULL; + goto error; rl.rlim_max = PyLong_AsLong(maxobj); if (rl.rlim_max == (rlim_t)-1 && PyErr_Occurred()) - return NULL; + goto error; #else /* The limits are probably bigger than a long */ rl.rlim_cur = PyLong_AsLongLong(curobj); if (rl.rlim_cur == (rlim_t)-1 && PyErr_Occurred()) - return NULL; + goto error; rl.rlim_max = PyLong_AsLongLong(maxobj); if (rl.rlim_max == (rlim_t)-1 && PyErr_Occurred()) - return NULL; + goto error; #endif rl.rlim_cur = rl.rlim_cur & RLIM_INFINITY; @@ -184,10 +196,15 @@ resource_setrlimit(PyObject *self, PyObject *args) "not allowed to raise maximum limit"); else PyErr_SetFromErrno(ResourceError); - return NULL; + goto error; } + Py_DECREF(limits); Py_INCREF(Py_None); return Py_None; + + error: + Py_DECREF(limits); + return NULL; } static PyObject *