traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

bpo-25862: Fix several bugs in the _io module. (GH-8026) 

They can be exposed when some C API calls fail due to lack of
memory.

* Failed Py_BuildValue() could cause an assertion error in the
  following TextIOWrapper.tell().
* input_chunk could be decrefed twice in TextIOWrapper.seek()
  after failed Py_BuildValue().
* initvalue could leak in StringIO.__getstate__() after failed
  PyDict_Copy().
(cherry picked from commit fdb5a50ef3)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
This commit is contained in:
Miss Islington (bot) 2018-06-30 11:25:50 -07:00 committed by GitHub
parent db7ac30ef5
commit e5153d0d40
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 17 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Modules/_io/stringio.c
View File

@ -870,8 +870,10 @@ stringio_getstate(stringio *self)
}
else {
dict = PyDict_Copy(self->dict);
if (dict == NULL)
if (dict == NULL) {
Py_DECREF(initvalue);
return NULL;
}
}
state = Py_BuildValue("(OOnN)", initvalue,

21
Modules/_io/textio.c
View File

@ -1540,11 +1540,16 @@ textiowrapper_read_chunk(textio *self, Py_ssize_t size_hint)
*/
PyObject *next_input = dec_buffer;
PyBytes_Concat(&next_input, input_chunk);
dec_buffer = NULL; /* Reference lost to PyBytes_Concat */
if (next_input == NULL) {
dec_buffer = NULL; /* Reference lost to PyBytes_Concat */
goto fail;
}
Py_XSETREF(self->snapshot, Py_BuildValue("NN", dec_flags, next_input));
PyObject *snapshot = Py_BuildValue("NN", dec_flags, next_input);
if (snapshot == NULL) {
dec_flags = NULL;
goto fail;
}
Py_XSETREF(self->snapshot, snapshot);
}
Py_DECREF(input_chunk);
@ -2093,6 +2098,7 @@ _io_TextIOWrapper_seek_impl(textio *self, PyObject *cookieObj, int whence)
cookie_type cookie;
PyObject *res;
int cmp;
PyObject *snapshot;
CHECK_ATTACHED(self);
CHECK_CLOSED(self);
@ -2227,11 +2233,11 @@ _io_TextIOWrapper_seek_impl(textio *self, PyObject *cookieObj, int whence)
goto fail;
}
self->snapshot = Py_BuildValue("iN", cookie.dec_flags, input_chunk);
if (self->snapshot == NULL) {
Py_DECREF(input_chunk);
snapshot = Py_BuildValue("iN", cookie.dec_flags, input_chunk);
if (snapshot == NULL) {
goto fail;
}
Py_XSETREF(self->snapshot, snapshot);
decoded = _PyObject_CallMethodId(self->decoder, &PyId_decode,
"Oi", input_chunk, (int)cookie.need_eof);
@ -2249,9 +2255,10 @@ _io_TextIOWrapper_seek_impl(textio *self, PyObject *cookieObj, int whence)
self->decoded_chars_used = cookie.chars_to_skip;
}
else {
self->snapshot = Py_BuildValue("iy", cookie.dec_flags, "");
if (self->snapshot == NULL)
snapshot = Py_BuildValue("iy", cookie.dec_flags, "");
if (snapshot == NULL)
goto fail;
Py_XSETREF(self->snapshot, snapshot);
}
/* Finally, reset the encoder (merely useful for proper BOM handling) */