Fix for
[ 784825 ] fix obscure crash in descriptor handling
Should be applied to release23-maint and in all likelyhood
release22-maint, too.
Certainly doesn't apply to release21-maint.
diff --git a/Lib/test/test_descr.py b/Lib/test/test_descr.py
index b3336d1..e001562 100644
--- a/Lib/test/test_descr.py
+++ b/Lib/test/test_descr.py
@@ -3938,6 +3938,36 @@
except RuntimeError:
pass
+def vicious_descriptor_nonsense():
+ # A potential segfault spotted by Thomas Wouters in mail to
+ # python-dev 2003-04-17, turned into an example & fixed by Michael
+ # Hudson just less than four months later...
+ if verbose:
+ print "Testing vicious_descriptor_nonsense..."
+
+ class Evil(object):
+ def __hash__(self):
+ return hash('attr')
+ def __eq__(self, other):
+ del C.attr
+ return 0
+
+ class Descr(object):
+ def __get__(self, ob, type=None):
+ return 1
+
+ class C(object):
+ attr = Descr()
+
+ c = C()
+ c.__dict__[Evil()] = 0
+
+ vereq(c.attr, 1)
+ # this makes a crash more likely:
+ import gc; gc.collect()
+ vereq(hasattr(c, 'attr'), False)
+
+
def test_main():
weakref_segfault() # Must be first, somehow
do_this_first()
@@ -4029,6 +4059,7 @@
proxysuper()
carloverre()
filefault()
+ vicious_descriptor_nonsense()
if verbose: print "All OK"
diff --git a/Objects/object.c b/Objects/object.c
index 93057c0..8c4bd0e 100644
--- a/Objects/object.c
+++ b/Objects/object.c
@@ -1412,12 +1412,15 @@
}
}
+ Py_XINCREF(descr);
+
f = NULL;
if (descr != NULL &&
PyType_HasFeature(descr->ob_type, Py_TPFLAGS_HAVE_CLASS)) {
f = descr->ob_type->tp_descr_get;
if (f != NULL && PyDescr_IsData(descr)) {
res = f(descr, obj, (PyObject *)obj->ob_type);
+ Py_DECREF(descr);
goto done;
}
}
@@ -1445,6 +1448,7 @@
res = PyDict_GetItem(dict, name);
if (res != NULL) {
Py_INCREF(res);
+ Py_XDECREF(descr);
goto done;
}
}
@@ -1452,12 +1456,13 @@
if (f != NULL) {
res = f(descr, obj, (PyObject *)obj->ob_type);
+ Py_DECREF(descr);
goto done;
}
if (descr != NULL) {
- Py_INCREF(descr);
res = descr;
+ /* descr was already increfed above */
goto done;
}
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 5c0f73a..af255f1 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -2010,6 +2010,7 @@
return meta_get(meta_attribute, (PyObject *)type,
(PyObject *)metatype);
}
+ Py_INCREF(meta_attribute);
}
/* No data descriptor found on metatype. Look in tp_dict of this
@@ -2018,6 +2019,9 @@
if (attribute != NULL) {
/* Implement descriptor functionality, if any */
descrgetfunc local_get = attribute->ob_type->tp_descr_get;
+
+ Py_XDECREF(meta_attribute);
+
if (local_get != NULL) {
/* NULL 2nd argument indicates the descriptor was
* found on the target object itself (or a base) */
@@ -2031,13 +2035,16 @@
/* No attribute found in local __dict__ (or bases): use the
* descriptor from the metatype, if any */
- if (meta_get != NULL)
- return meta_get(meta_attribute, (PyObject *)type,
- (PyObject *)metatype);
+ if (meta_get != NULL) {
+ PyObject *res;
+ res = meta_get(meta_attribute, (PyObject *)type,
+ (PyObject *)metatype);
+ Py_DECREF(meta_attribute);
+ return res;
+ }
/* If an ordinary attribute was found on the metatype, return it now */
if (meta_attribute != NULL) {
- Py_INCREF(meta_attribute);
return meta_attribute;
}