commit fbb1c5ee068d209e33f6e15ecb4821d5d8b107fa
author Serhiy Storchaka <storchaka@gmail.com> Wed Mar 30 20:40:02 2016 +0300
committer Serhiy Storchaka <storchaka@gmail.com> Wed Mar 30 20:40:02 2016 +0300
tree 4ae6657a598c5cfe5357f3106d956ed721d83e24
parent 13b3acd13e35b5e619c3d1aab90aaf54abc1fb53

Issue #26494: Fixed crash on iterating exhausting iterators.

Affected classes are generic sequence iterators, iterators of str, bytes,
bytearray, list, tuple, set, frozenset, dict, OrderedDict, corresponding
views and os.scandir() iterator.

Objects/bytearrayobject.c

diff --git a/Objects/bytearrayobject.c b/Objects/bytearrayobject.c
index c59ad24..c723a9c 100644
--- a/Objects/bytearrayobject.c
+++ b/Objects/bytearrayobject.c
@@ -3186,8 +3186,8 @@
         return item;
     }
 
-    Py_DECREF(seq);
     it->it_seq = NULL;
+    Py_DECREF(seq);
     return NULL;
 }
 

Objects/bytesobject.c

diff --git a/Objects/bytesobject.c b/Objects/bytesobject.c
index 51d0871..495c3eb 100644
--- a/Objects/bytesobject.c
+++ b/Objects/bytesobject.c
@@ -3628,8 +3628,8 @@
         return item;
     }
 
-    Py_DECREF(seq);
     it->it_seq = NULL;
+    Py_DECREF(seq);
     return NULL;
 }
 

Objects/dictobject.c

diff --git a/Objects/dictobject.c b/Objects/dictobject.c
index e4dff98..d774586 100644
--- a/Objects/dictobject.c
+++ b/Objects/dictobject.c
@@ -2985,8 +2985,8 @@
     return key;
 
 fail:
-    Py_DECREF(d);
     di->di_dict = NULL;
+    Py_DECREF(d);
     return NULL;
 }
 
@@ -3066,8 +3066,8 @@
     return value;
 
 fail:
-    Py_DECREF(d);
     di->di_dict = NULL;
+    Py_DECREF(d);
     return NULL;
 }
 
@@ -3161,8 +3161,8 @@
     return result;
 
 fail:
-    Py_DECREF(d);
     di->di_dict = NULL;
+    Py_DECREF(d);
     return NULL;
 }
 

Objects/iterobject.c

diff --git a/Objects/iterobject.c b/Objects/iterobject.c
index 2fb0c88..ab29ff8 100644
--- a/Objects/iterobject.c
+++ b/Objects/iterobject.c
@@ -69,8 +69,8 @@
         PyErr_ExceptionMatches(PyExc_StopIteration))
     {
         PyErr_Clear();
-        Py_DECREF(seq);
         it->it_seq = NULL;
+        Py_DECREF(seq);
     }
     return NULL;
 }

Objects/listobject.c

diff --git a/Objects/listobject.c b/Objects/listobject.c
index eee7c68..d688179 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -2782,8 +2782,8 @@
         return item;
     }
 
-    Py_DECREF(seq);
     it->it_seq = NULL;
+    Py_DECREF(seq);
     return NULL;
 }
 
@@ -2912,9 +2912,17 @@
 listreviter_next(listreviterobject *it)
 {
     PyObject *item;
-    Py_ssize_t index = it->it_index;
-    PyListObject *seq = it->it_seq;
+    Py_ssize_t index;
+    PyListObject *seq;
 
+    assert(it != NULL);
+    seq = it->it_seq;
+    if (seq == NULL) {
+        return NULL;
+    }
+    assert(PyList_Check(seq));
+
+    index = it->it_index;
     if (index>=0 && index < PyList_GET_SIZE(seq)) {
         item = PyList_GET_ITEM(seq, index);
         it->it_index--;
@@ -2922,10 +2930,8 @@
         return item;
     }
     it->it_index = -1;
-    if (seq != NULL) {
-        it->it_seq = NULL;
-        Py_DECREF(seq);
-    }
+    it->it_seq = NULL;
+    Py_DECREF(seq);
     return NULL;
 }
 

Objects/setobject.c

diff --git a/Objects/setobject.c b/Objects/setobject.c
index 582f280..4ef692d 100644
--- a/Objects/setobject.c
+++ b/Objects/setobject.c
@@ -839,8 +839,8 @@
     return key;
 
 fail:
-    Py_DECREF(so);
     si->si_set = NULL;
+    Py_DECREF(so);
     return NULL;
 }
 

Objects/tupleobject.c

diff --git a/Objects/tupleobject.c b/Objects/tupleobject.c
index 7efa1a6..7920fec 100644
--- a/Objects/tupleobject.c
+++ b/Objects/tupleobject.c
@@ -964,8 +964,8 @@
         return item;
     }
 
-    Py_DECREF(seq);
     it->it_seq = NULL;
+    Py_DECREF(seq);
     return NULL;
 }
 

Objects/unicodeobject.c

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index adc4615..230125b 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -15149,8 +15149,8 @@
         return item;
     }
 
-    Py_DECREF(seq);
     it->it_seq = NULL;
+    Py_DECREF(seq);
     return NULL;
 }