Fix obscure set crashers (#4420). Backport of d56b3cafb1e6, reviewed by Raymond.
diff --git a/Objects/setobject.c b/Objects/setobject.c
index 00cabe6..802f45f 100644
--- a/Objects/setobject.c
+++ b/Objects/setobject.c
@@ -362,12 +362,14 @@
set_add_entry(register PySetObject *so, setentry *entry)
{
register Py_ssize_t n_used;
+ PyObject *key = entry->key;
+ long hash = entry->hash;
assert(so->fill <= so->mask); /* at least one empty slot */
n_used = so->used;
- Py_INCREF(entry->key);
- if (set_insert_key(so, entry->key, entry->hash) == -1) {
- Py_DECREF(entry->key);
+ Py_INCREF(key);
+ if (set_insert_key(so, key, hash) == -1) {
+ Py_DECREF(key);
return -1;
}
if (!(so->used > n_used && so->fill*3 >= (so->mask+1)*2))
@@ -647,6 +649,8 @@
set_merge(PySetObject *so, PyObject *otherset)
{
PySetObject *other;
+ PyObject *key;
+ long hash;
register Py_ssize_t i;
register setentry *entry;
@@ -667,11 +671,13 @@
}
for (i = 0; i <= other->mask; i++) {
entry = &other->table[i];
- if (entry->key != NULL &&
- entry->key != dummy) {
- Py_INCREF(entry->key);
- if (set_insert_key(so, entry->key, entry->hash) == -1) {
- Py_DECREF(entry->key);
+ key = entry->key;
+ hash = entry->hash;
+ if (key != NULL &&
+ key != dummy) {
+ Py_INCREF(key);
+ if (set_insert_key(so, key, hash) == -1) {
+ Py_DECREF(key);
return -1;
}
}
@@ -1640,15 +1646,22 @@
while (_PyDict_Next(other, &pos, &key, &value, &hash)) {
setentry an_entry;
+ Py_INCREF(key);
an_entry.hash = hash;
an_entry.key = key;
+
rv = set_discard_entry(so, &an_entry);
- if (rv == -1)
+ if (rv == -1) {
+ Py_DECREF(key);
return NULL;
- if (rv == DISCARD_NOTFOUND) {
- if (set_add_entry(so, &an_entry) == -1)
- return NULL;
}
+ if (rv == DISCARD_NOTFOUND) {
+ if (set_add_entry(so, &an_entry) == -1) {
+ Py_DECREF(key);
+ return NULL;
+ }
+ }
+ Py_DECREF(key);
}
Py_RETURN_NONE;
}