commit 11b85abbae8aaa8410b19f358abd7b401881bb1c
author Pablo Galindo <Pablogsal@gmail.com> Sat Mar 27 03:51:46 2021 +0000
committer GitHub <noreply@github.com> Sat Mar 27 03:51:46 2021 +0000
tree 1f47d522c0104e5e2cac5ef73dc4d6b51bba1a97
parent 027b6699276ed8d9f68425697ac89bf61e54e6b9

bpo-43636: Validate the version tag in _PyType_Lookup (GH-25032)

Objects/typeobject.c

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index d1bbbe7..8dafbbf 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -424,7 +424,7 @@ assign_version_tag(struct type_cache *cache, PyTypeObject *type)
     if (type->tp_version_tag == 0) {
         // Wrap-around or just starting Python - clear the whole cache
         type_cache_clear(cache, 1);
-        return 1;
+        return 0;
     }
 
     bases = type->tp_bases;
@@ -3361,6 +3361,7 @@ _PyType_Lookup(PyTypeObject *type, PyObject *name)
 #if MCACHE_STATS
         cache->hits++;
 #endif
+        assert(_PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG));
         return entry->value;
     }
 
@@ -3398,6 +3399,7 @@ _PyType_Lookup(PyTypeObject *type, PyObject *name)
             cache->misses++;
         }
 #endif
+        assert(_PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG));
         Py_SETREF(entry->name, Py_NewRef(name));
     }
     return res;