Issue #14010: Fix a crash when iterating or deleting deeply nested filters
in itertools module (i.e. itertools.izip(), itertools.chain(), etc).
diff --git a/Modules/itertoolsmodule.c b/Modules/itertoolsmodule.c
index ea82291..73c5e30 100644
--- a/Modules/itertoolsmodule.c
+++ b/Modules/itertoolsmodule.c
@@ -54,12 +54,14 @@
groupby_dealloc(groupbyobject *gbo)
{
PyObject_GC_UnTrack(gbo);
+ Py_TRASHCAN_SAFE_BEGIN(gbo)
Py_XDECREF(gbo->it);
Py_XDECREF(gbo->keyfunc);
Py_XDECREF(gbo->tgtkey);
Py_XDECREF(gbo->currkey);
Py_XDECREF(gbo->currvalue);
Py_TYPE(gbo)->tp_free(gbo);
+ Py_TRASHCAN_SAFE_END(gbo)
}
static int
@@ -741,9 +743,11 @@
cycle_dealloc(cycleobject *lz)
{
PyObject_GC_UnTrack(lz);
+ Py_TRASHCAN_SAFE_BEGIN(lz)
Py_XDECREF(lz->saved);
Py_XDECREF(lz->it);
Py_TYPE(lz)->tp_free(lz);
+ Py_TRASHCAN_SAFE_END(lz)
}
static int
@@ -886,9 +890,11 @@
dropwhile_dealloc(dropwhileobject *lz)
{
PyObject_GC_UnTrack(lz);
+ Py_TRASHCAN_SAFE_BEGIN(lz)
Py_XDECREF(lz->func);
Py_XDECREF(lz->it);
Py_TYPE(lz)->tp_free(lz);
+ Py_TRASHCAN_SAFE_END(lz)
}
static int
@@ -909,7 +915,10 @@
iternext = *Py_TYPE(it)->tp_iternext;
for (;;) {
+ if (Py_EnterRecursiveCall(" while iterating"))
+ return NULL;
item = iternext(it);
+ Py_LeaveRecursiveCall();
if (item == NULL)
return NULL;
if (lz->start == 1)
@@ -1030,9 +1039,11 @@
takewhile_dealloc(takewhileobject *lz)
{
PyObject_GC_UnTrack(lz);
+ Py_TRASHCAN_SAFE_BEGIN(lz)
Py_XDECREF(lz->func);
Py_XDECREF(lz->it);
Py_TYPE(lz)->tp_free(lz);
+ Py_TRASHCAN_SAFE_END(lz)
}
static int
@@ -1053,7 +1064,10 @@
if (lz->stop == 1)
return NULL;
+ if (Py_EnterRecursiveCall(" while iterating"))
+ return NULL;
item = (*Py_TYPE(it)->tp_iternext)(it);
+ Py_LeaveRecursiveCall();
if (item == NULL)
return NULL;
@@ -1221,8 +1235,10 @@
islice_dealloc(isliceobject *lz)
{
PyObject_GC_UnTrack(lz);
+ Py_TRASHCAN_SAFE_BEGIN(lz)
Py_XDECREF(lz->it);
Py_TYPE(lz)->tp_free(lz);
+ Py_TRASHCAN_SAFE_END(lz)
}
static int
@@ -1243,7 +1259,10 @@
iternext = *Py_TYPE(it)->tp_iternext;
while (lz->cnt < lz->next) {
+ if (Py_EnterRecursiveCall(" while iterating"))
+ return NULL;
item = iternext(it);
+ Py_LeaveRecursiveCall();
if (item == NULL)
return NULL;
Py_DECREF(item);
@@ -1251,7 +1270,10 @@
}
if (stop != -1 && lz->cnt >= stop)
return NULL;
+ if (Py_EnterRecursiveCall(" while iterating"))
+ return NULL;
item = iternext(it);
+ Py_LeaveRecursiveCall();
if (item == NULL)
return NULL;
lz->cnt++;
@@ -1364,9 +1386,11 @@
starmap_dealloc(starmapobject *lz)
{
PyObject_GC_UnTrack(lz);
+ Py_TRASHCAN_SAFE_BEGIN(lz)
Py_XDECREF(lz->func);
Py_XDECREF(lz->it);
Py_TYPE(lz)->tp_free(lz);
+ Py_TRASHCAN_SAFE_END(lz)
}
static int
@@ -1384,7 +1408,10 @@
PyObject *result;
PyObject *it = lz->it;
+ if (Py_EnterRecursiveCall(" while iterating"))
+ return NULL;
args = (*Py_TYPE(it)->tp_iternext)(it);
+ Py_LeaveRecursiveCall();
if (args == NULL)
return NULL;
if (!PyTuple_CheckExact(args)) {
@@ -1509,9 +1536,11 @@
imap_dealloc(imapobject *lz)
{
PyObject_GC_UnTrack(lz);
+ Py_TRASHCAN_SAFE_BEGIN(lz)
Py_XDECREF(lz->iters);
Py_XDECREF(lz->func);
Py_TYPE(lz)->tp_free(lz);
+ Py_TRASHCAN_SAFE_END(lz)
}
static int
@@ -1686,9 +1715,11 @@
chain_dealloc(chainobject *lz)
{
PyObject_GC_UnTrack(lz);
+ Py_TRASHCAN_SAFE_BEGIN(lz)
Py_XDECREF(lz->active);
Py_XDECREF(lz->source);
Py_TYPE(lz)->tp_free(lz);
+ Py_TRASHCAN_SAFE_END(lz)
}
static int
@@ -2837,9 +2868,11 @@
compress_dealloc(compressobject *lz)
{
PyObject_GC_UnTrack(lz);
+ Py_TRASHCAN_SAFE_BEGIN(lz)
Py_XDECREF(lz->data);
Py_XDECREF(lz->selectors);
Py_TYPE(lz)->tp_free(lz);
+ Py_TRASHCAN_SAFE_END(lz)
}
static int
@@ -2866,11 +2899,16 @@
exception first).
*/
- datum = datanext(data);
- if (datum == NULL)
+ if (Py_EnterRecursiveCall(" while iterating"))
return NULL;
+ datum = datanext(data);
+ if (datum == NULL) {
+ Py_LeaveRecursiveCall();
+ return NULL;
+ }
selector = selectornext(selectors);
+ Py_LeaveRecursiveCall();
if (selector == NULL) {
Py_DECREF(datum);
return NULL;
@@ -2983,9 +3021,11 @@
ifilter_dealloc(ifilterobject *lz)
{
PyObject_GC_UnTrack(lz);
+ Py_TRASHCAN_SAFE_BEGIN(lz)
Py_XDECREF(lz->func);
Py_XDECREF(lz->it);
Py_TYPE(lz)->tp_free(lz);
+ Py_TRASHCAN_SAFE_END(lz)
}
static int
@@ -3006,7 +3046,10 @@
iternext = *Py_TYPE(it)->tp_iternext;
for (;;) {
+ if (Py_EnterRecursiveCall(" while iterating"))
+ return NULL;
item = iternext(it);
+ Py_LeaveRecursiveCall();
if (item == NULL)
return NULL;
@@ -3128,9 +3171,11 @@
ifilterfalse_dealloc(ifilterfalseobject *lz)
{
PyObject_GC_UnTrack(lz);
+ Py_TRASHCAN_SAFE_BEGIN(lz)
Py_XDECREF(lz->func);
Py_XDECREF(lz->it);
Py_TYPE(lz)->tp_free(lz);
+ Py_TRASHCAN_SAFE_END(lz)
}
static int
@@ -3151,7 +3196,10 @@
iternext = *Py_TYPE(it)->tp_iternext;
for (;;) {
+ if (Py_EnterRecursiveCall(" while iterating"))
+ return NULL;
item = iternext(it);
+ Py_LeaveRecursiveCall();
if (item == NULL)
return NULL;
@@ -3551,9 +3599,11 @@
izip_dealloc(izipobject *lz)
{
PyObject_GC_UnTrack(lz);
+ Py_TRASHCAN_SAFE_BEGIN(lz)
Py_XDECREF(lz->ittuple);
Py_XDECREF(lz->result);
Py_TYPE(lz)->tp_free(lz);
+ Py_TRASHCAN_SAFE_END(lz)
}
static int
@@ -3576,15 +3626,15 @@
if (tuplesize == 0)
return NULL;
+ if (Py_EnterRecursiveCall(" while iterating"))
+ return NULL;
if (Py_REFCNT(result) == 1) {
Py_INCREF(result);
for (i=0 ; i < tuplesize ; i++) {
it = PyTuple_GET_ITEM(lz->ittuple, i);
item = (*Py_TYPE(it)->tp_iternext)(it);
- if (item == NULL) {
- Py_DECREF(result);
- return NULL;
- }
+ if (item == NULL)
+ goto error;
olditem = PyTuple_GET_ITEM(result, i);
PyTuple_SET_ITEM(result, i, item);
Py_DECREF(olditem);
@@ -3592,18 +3642,21 @@
} else {
result = PyTuple_New(tuplesize);
if (result == NULL)
- return NULL;
+ goto error;
for (i=0 ; i < tuplesize ; i++) {
it = PyTuple_GET_ITEM(lz->ittuple, i);
item = (*Py_TYPE(it)->tp_iternext)(it);
- if (item == NULL) {
- Py_DECREF(result);
- return NULL;
- }
+ if (item == NULL)
+ goto error;
PyTuple_SET_ITEM(result, i, item);
}
}
+ Py_LeaveRecursiveCall();
return result;
+error:
+ Py_XDECREF(result);
+ Py_LeaveRecursiveCall();
+ return NULL;
}
PyDoc_STRVAR(izip_doc,
@@ -3892,10 +3945,12 @@
izip_longest_dealloc(iziplongestobject *lz)
{
PyObject_GC_UnTrack(lz);
+ Py_TRASHCAN_SAFE_BEGIN(lz)
Py_XDECREF(lz->ittuple);
Py_XDECREF(lz->result);
Py_XDECREF(lz->fillvalue);
Py_TYPE(lz)->tp_free(lz);
+ Py_TRASHCAN_SAFE_END(lz)
}
static int