Issue #24098: Fixed possible crash when AST is changed in process of
compiling it.
diff --git a/Python/Python-ast.c b/Python/Python-ast.c
index 6cf99ec..28c95b0 100644
--- a/Python/Python-ast.c
+++ b/Python/Python-ast.c
@@ -3351,6 +3351,10 @@
stmt_ty value;
res = obj2ast_stmt(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "Module field \"body\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(body, i, value);
}
Py_XDECREF(tmp);
@@ -3387,6 +3391,10 @@
stmt_ty value;
res = obj2ast_stmt(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "Interactive field \"body\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(body, i, value);
}
Py_XDECREF(tmp);
@@ -3446,6 +3454,10 @@
stmt_ty value;
res = obj2ast_stmt(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "Suite field \"body\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(body, i, value);
}
Py_XDECREF(tmp);
@@ -3555,6 +3567,10 @@
stmt_ty value;
res = obj2ast_stmt(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "FunctionDef field \"body\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(body, i, value);
}
Py_XDECREF(tmp);
@@ -3580,6 +3596,10 @@
expr_ty value;
res = obj2ast_expr(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "FunctionDef field \"decorator_list\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(decorator_list, i, value);
}
Py_XDECREF(tmp);
@@ -3632,6 +3652,10 @@
expr_ty value;
res = obj2ast_expr(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "ClassDef field \"bases\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(bases, i, value);
}
Py_XDECREF(tmp);
@@ -3657,6 +3681,10 @@
stmt_ty value;
res = obj2ast_stmt(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "ClassDef field \"body\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(body, i, value);
}
Py_XDECREF(tmp);
@@ -3682,6 +3710,10 @@
expr_ty value;
res = obj2ast_expr(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "ClassDef field \"decorator_list\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(decorator_list, i, value);
}
Py_XDECREF(tmp);
@@ -3741,6 +3773,10 @@
expr_ty value;
res = obj2ast_expr(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "Delete field \"targets\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(targets, i, value);
}
Py_XDECREF(tmp);
@@ -3778,6 +3814,10 @@
expr_ty value;
res = obj2ast_expr(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "Assign field \"targets\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(targets, i, value);
}
Py_XDECREF(tmp);
@@ -3888,6 +3928,10 @@
expr_ty value;
res = obj2ast_expr(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "Print field \"values\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(values, i, value);
}
Py_XDECREF(tmp);
@@ -3963,6 +4007,10 @@
stmt_ty value;
res = obj2ast_stmt(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "For field \"body\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(body, i, value);
}
Py_XDECREF(tmp);
@@ -3988,6 +4036,10 @@
stmt_ty value;
res = obj2ast_stmt(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "For field \"orelse\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(orelse, i, value);
}
Py_XDECREF(tmp);
@@ -4039,6 +4091,10 @@
stmt_ty value;
res = obj2ast_stmt(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "While field \"body\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(body, i, value);
}
Py_XDECREF(tmp);
@@ -4064,6 +4120,10 @@
stmt_ty value;
res = obj2ast_stmt(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "While field \"orelse\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(orelse, i, value);
}
Py_XDECREF(tmp);
@@ -4114,6 +4174,10 @@
stmt_ty value;
res = obj2ast_stmt(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "If field \"body\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(body, i, value);
}
Py_XDECREF(tmp);
@@ -4139,6 +4203,10 @@
stmt_ty value;
res = obj2ast_stmt(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "If field \"orelse\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(orelse, i, value);
}
Py_XDECREF(tmp);
@@ -4200,6 +4268,10 @@
stmt_ty value;
res = obj2ast_stmt(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "With field \"body\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(body, i, value);
}
Py_XDECREF(tmp);
@@ -4285,6 +4357,10 @@
stmt_ty value;
res = obj2ast_stmt(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "TryExcept field \"body\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(body, i, value);
}
Py_XDECREF(tmp);
@@ -4310,6 +4386,10 @@
excepthandler_ty value;
res = obj2ast_excepthandler(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "TryExcept field \"handlers\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(handlers, i, value);
}
Py_XDECREF(tmp);
@@ -4335,6 +4415,10 @@
stmt_ty value;
res = obj2ast_stmt(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "TryExcept field \"orelse\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(orelse, i, value);
}
Py_XDECREF(tmp);
@@ -4373,6 +4457,10 @@
stmt_ty value;
res = obj2ast_stmt(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "TryFinally field \"body\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(body, i, value);
}
Py_XDECREF(tmp);
@@ -4398,6 +4486,10 @@
stmt_ty value;
res = obj2ast_stmt(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "TryFinally field \"finalbody\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(finalbody, i, value);
}
Py_XDECREF(tmp);
@@ -4469,6 +4561,10 @@
alias_ty value;
res = obj2ast_alias(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "Import field \"names\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(names, i, value);
}
Py_XDECREF(tmp);
@@ -4518,6 +4614,10 @@
alias_ty value;
res = obj2ast_alias(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "ImportFrom field \"names\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(names, i, value);
}
Py_XDECREF(tmp);
@@ -4613,6 +4713,10 @@
identifier value;
res = obj2ast_identifier(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "Global field \"names\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(names, i, value);
}
Py_XDECREF(tmp);
@@ -4761,6 +4865,10 @@
expr_ty value;
res = obj2ast_expr(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "BoolOp field \"values\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(values, i, value);
}
Py_XDECREF(tmp);
@@ -4968,6 +5076,10 @@
expr_ty value;
res = obj2ast_expr(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "Dict field \"keys\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(keys, i, value);
}
Py_XDECREF(tmp);
@@ -4993,6 +5105,10 @@
expr_ty value;
res = obj2ast_expr(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "Dict field \"values\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(values, i, value);
}
Py_XDECREF(tmp);
@@ -5029,6 +5145,10 @@
expr_ty value;
res = obj2ast_expr(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "Set field \"elts\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(elts, i, value);
}
Py_XDECREF(tmp);
@@ -5078,6 +5198,10 @@
comprehension_ty value;
res = obj2ast_comprehension(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "ListComp field \"generators\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(generators, i, value);
}
Py_XDECREF(tmp);
@@ -5127,6 +5251,10 @@
comprehension_ty value;
res = obj2ast_comprehension(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "SetComp field \"generators\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(generators, i, value);
}
Py_XDECREF(tmp);
@@ -5189,6 +5317,10 @@
comprehension_ty value;
res = obj2ast_comprehension(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "DictComp field \"generators\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(generators, i, value);
}
Py_XDECREF(tmp);
@@ -5239,6 +5371,10 @@
comprehension_ty value;
res = obj2ast_comprehension(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "GeneratorExp field \"generators\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(generators, i, value);
}
Py_XDECREF(tmp);
@@ -5311,6 +5447,10 @@
cmpop_ty value;
res = obj2ast_cmpop(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "Compare field \"ops\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(ops, i, value);
}
Py_XDECREF(tmp);
@@ -5336,6 +5476,10 @@
expr_ty value;
res = obj2ast_expr(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "Compare field \"comparators\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(comparators, i, value);
}
Py_XDECREF(tmp);
@@ -5389,6 +5533,10 @@
expr_ty value;
res = obj2ast_expr(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "Call field \"args\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(args, i, value);
}
Py_XDECREF(tmp);
@@ -5414,6 +5562,10 @@
keyword_ty value;
res = obj2ast_keyword(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "Call field \"keywords\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(keywords, i, value);
}
Py_XDECREF(tmp);
@@ -5677,6 +5829,10 @@
expr_ty value;
res = obj2ast_expr(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "List field \"elts\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(elts, i, value);
}
Py_XDECREF(tmp);
@@ -5726,6 +5882,10 @@
expr_ty value;
res = obj2ast_expr(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "Tuple field \"elts\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(elts, i, value);
}
Py_XDECREF(tmp);
@@ -5913,6 +6073,10 @@
slice_ty value;
res = obj2ast_slice(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "ExtSlice field \"dims\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(dims, i, value);
}
Py_XDECREF(tmp);
@@ -6290,6 +6454,10 @@
expr_ty value;
res = obj2ast_expr(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "comprehension field \"ifs\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(ifs, i, value);
}
Py_XDECREF(tmp);
@@ -6390,6 +6558,10 @@
stmt_ty value;
res = obj2ast_stmt(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "ExceptHandler field \"body\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(body, i, value);
}
Py_XDECREF(tmp);
@@ -6438,6 +6610,10 @@
expr_ty value;
res = obj2ast_expr(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "arguments field \"args\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(args, i, value);
}
Py_XDECREF(tmp);
@@ -6485,6 +6661,10 @@
expr_ty value;
res = obj2ast_expr(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
+ if (len != PyList_GET_SIZE(tmp)) {
+ PyErr_SetString(PyExc_RuntimeError, "arguments field \"defaults\" changed size during iteration");
+ goto failed;
+ }
asdl_seq_SET(defaults, i, value);
}
Py_XDECREF(tmp);