[2.7] bpo-30243: Fixed the possibility of a crash in _json. (GH-1420) (#1471)
It was possible to get a core dump by using uninitialized
_json objects. Now __new__ methods create initialized objects.
__init__ methods are removed..
(cherry picked from commit 76a3e51a403bc84ed536921866c86dd7d07aaa7e)
diff --git a/Misc/NEWS b/Misc/NEWS
index 01f4fef..181edf1 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -42,6 +42,10 @@
Library
-------
+- bpo-30243: Removed the __init__ methods of _json's scanner and encoder.
+ Misusing them could cause memory leaks or crashes. Now scanner and encoder
+ objects are completely initialized in the __new__ methods.
+
- Revert bpo-26293 for zipfile breakage. See also bpo-29094.
- bpo-30070: Fixed leaks and crashes in errors handling in the parser module.
diff --git a/Modules/_json.c b/Modules/_json.c
index 7860e9a..42c93ab 100644
--- a/Modules/_json.c
+++ b/Modules/_json.c
@@ -95,16 +95,12 @@
_build_rval_index_tuple(PyObject *rval, Py_ssize_t idx);
static PyObject *
scanner_new(PyTypeObject *type, PyObject *args, PyObject *kwds);
-static int
-scanner_init(PyObject *self, PyObject *args, PyObject *kwds);
static void
scanner_dealloc(PyObject *self);
static int
scanner_clear(PyObject *self);
static PyObject *
encoder_new(PyTypeObject *type, PyObject *args, PyObject *kwds);
-static int
-encoder_init(PyObject *self, PyObject *args, PyObject *kwds);
static void
encoder_dealloc(PyObject *self);
static int
@@ -1707,32 +1703,15 @@
scanner_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
{
PyScannerObject *s;
- s = (PyScannerObject *)type->tp_alloc(type, 0);
- if (s != NULL) {
- s->encoding = NULL;
- s->strict = NULL;
- s->object_hook = NULL;
- s->pairs_hook = NULL;
- s->parse_float = NULL;
- s->parse_int = NULL;
- s->parse_constant = NULL;
- }
- return (PyObject *)s;
-}
-
-static int
-scanner_init(PyObject *self, PyObject *args, PyObject *kwds)
-{
- /* Initialize Scanner object */
PyObject *ctx;
static char *kwlist[] = {"context", NULL};
- PyScannerObject *s;
-
- assert(PyScanner_Check(self));
- s = (PyScannerObject *)self;
if (!PyArg_ParseTupleAndKeywords(args, kwds, "O:make_scanner", kwlist, &ctx))
- return -1;
+ return NULL;
+
+ s = (PyScannerObject *)type->tp_alloc(type, 0);
+ if (s == NULL)
+ return NULL;
/* PyString_AS_STRING is used on encoding */
s->encoding = PyObject_GetAttrString(ctx, "encoding");
@@ -1776,17 +1755,11 @@
if (s->parse_constant == NULL)
goto bail;
- return 0;
+ return (PyObject *)s;
bail:
- Py_CLEAR(s->encoding);
- Py_CLEAR(s->strict);
- Py_CLEAR(s->object_hook);
- Py_CLEAR(s->pairs_hook);
- Py_CLEAR(s->parse_float);
- Py_CLEAR(s->parse_int);
- Py_CLEAR(s->parse_constant);
- return -1;
+ Py_DECREF(s);
+ return NULL;
}
PyDoc_STRVAR(scanner_doc, "JSON scanner object");
@@ -1829,7 +1802,7 @@
0, /* tp_descr_get */
0, /* tp_descr_set */
0, /* tp_dictoffset */
- scanner_init, /* tp_init */
+ 0, /* tp_init */
0,/* PyType_GenericAlloc, */ /* tp_alloc */
scanner_new, /* tp_new */
0,/* PyObject_GC_Del, */ /* tp_free */
@@ -1838,25 +1811,6 @@
static PyObject *
encoder_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
{
- PyEncoderObject *s;
- s = (PyEncoderObject *)type->tp_alloc(type, 0);
- if (s != NULL) {
- s->markers = NULL;
- s->defaultfn = NULL;
- s->encoder = NULL;
- s->indent = NULL;
- s->key_separator = NULL;
- s->item_separator = NULL;
- s->sort_keys = NULL;
- s->skipkeys = NULL;
- }
- return (PyObject *)s;
-}
-
-static int
-encoder_init(PyObject *self, PyObject *args, PyObject *kwds)
-{
- /* initialize Encoder object */
static char *kwlist[] = {"markers", "default", "encoder", "indent", "key_separator", "item_separator", "sort_keys", "skipkeys", "allow_nan", NULL};
PyEncoderObject *s;
@@ -1864,25 +1818,26 @@
PyObject *item_separator, *sort_keys, *skipkeys, *allow_nan_obj;
int allow_nan;
- assert(PyEncoder_Check(self));
- s = (PyEncoderObject *)self;
-
if (!PyArg_ParseTupleAndKeywords(args, kwds, "OOOOOOOOO:make_encoder", kwlist,
&markers, &defaultfn, &encoder, &indent, &key_separator, &item_separator,
&sort_keys, &skipkeys, &allow_nan_obj))
- return -1;
+ return NULL;
allow_nan = PyObject_IsTrue(allow_nan_obj);
if (allow_nan < 0)
- return -1;
+ return NULL;
if (markers != Py_None && !PyDict_Check(markers)) {
PyErr_Format(PyExc_TypeError,
"make_encoder() argument 1 must be dict or None, "
"not %.200s", Py_TYPE(markers)->tp_name);
- return -1;
+ return NULL;
}
+ s = (PyEncoderObject *)type->tp_alloc(type, 0);
+ if (s == NULL)
+ return NULL;
+
s->markers = markers;
s->defaultfn = defaultfn;
s->encoder = encoder;
@@ -1902,7 +1857,7 @@
Py_INCREF(s->item_separator);
Py_INCREF(s->sort_keys);
Py_INCREF(s->skipkeys);
- return 0;
+ return (PyObject *)s;
}
static PyObject *
@@ -2423,7 +2378,7 @@
0, /* tp_descr_get */
0, /* tp_descr_set */
0, /* tp_dictoffset */
- encoder_init, /* tp_init */
+ 0, /* tp_init */
0, /* tp_alloc */
encoder_new, /* tp_new */
0, /* tp_free */
@@ -2448,10 +2403,8 @@
init_json(void)
{
PyObject *m;
- PyScannerType.tp_new = PyType_GenericNew;
if (PyType_Ready(&PyScannerType) < 0)
return;
- PyEncoderType.tp_new = PyType_GenericNew;
if (PyType_Ready(&PyEncoderType) < 0)
return;
m = Py_InitModule3("_json", speedups_methods, module_doc);