Movatterモバイル変換


[0]ホーム

URL:


homepage

Issue24091

This issue trackerhas been migrated toGitHub, and is currentlyread-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title:Use after free in Element.extend (1)
Type:crashStage:resolved
Components:Extension Modules, XMLVersions:Python 3.4, Python 3.5
process
Status:closedResolution:fixed
Dependencies:Superseder:
Assigned To: serhiy.storchakaNosy List: Arfrever, christian.heimes, eli.bendersky, pkt, python-dev, scoder, serhiy.storchaka
Priority:normalKeywords:patch

Created on2015-05-01 13:56 bypkt, last changed2022-04-11 14:58 byadmin. This issue is nowclosed.

Files
File nameUploadedDescriptionEdit
poc_elt_extend1.pypkt,2015-05-01 13:56
etree_crashes.patchserhiy.storchaka,2015-05-02 20:34review
Messages (3)
msg242305 -(view)Author: paul (pkt)Date: 2015-05-01 13:56
# 1055        for (i = 0; i < seqlen; i++) {# (gdb) n# 1056            PyObject* element = PySequence_Fast_GET_ITEM(seq, i);# (gdb) n# 1057            if (!PyObject_IsInstance(element, (PyObject *)&Element_Type)) {# (gdb) print *element# $19 = {_ob_next = 0x4060e6fc, _ob_prev = 0x4056cd8c, ob_refcnt = 1, ob_type = 0x406de3e4}# (gdb) n# 1066            if (element_add_subelement(self, element) < 0) {# (gdb) print *element# $20 = {_ob_next = 0xdbdbdbdb, _ob_prev = 0xdbdbdbdb, ob_refcnt = -606348325, ob_type = 0xdbdbdbdb}# # Fatal Python error: /home/p/Python-3.4.1/Modules/_elementtree.c:267 object at 0x4056c4cc has negative ref count -606348326# # "element" is removed in __getattribute__ method.
msg242430 -(view)Author: Serhiy Storchaka (serhiy.storchaka)*(Python committer)Date: 2015-05-02 20:34
Here is a patch that fixesissue24091,issue24092,issue24093, and several other similar bugs.
msg243489 -(view)Author: Roundup Robot (python-dev)(Python triager)Date: 2015-05-18 15:34
New changeset34523e53a342 by Serhiy Storchaka in branch '2.7':Issue#24091: Fixed various crashes in corner cases in cElementTree.https://hg.python.org/cpython/rev/34523e53a342New changeset157c4afca186 by Serhiy Storchaka in branch '3.4':Issue#24091: Fixed various crashes in corner cases in C implementation ofhttps://hg.python.org/cpython/rev/157c4afca186New changeseta8b8d1b211fe by Serhiy Storchaka in branch 'default':Issue#24091: Fixed various crashes in corner cases in C implementation ofhttps://hg.python.org/cpython/rev/a8b8d1b211fe
History
DateUserActionArgs
2022-04-11 14:58:16adminsetgithub: 68279
2015-05-19 12:51:10serhiy.storchakasetstatus: open -> closed
resolution: fixed
stage: patch review -> resolved
2015-05-18 15:34:13python-devsetnosy: +python-dev
messages: +msg243489
2015-05-03 06:43:47Arfreversetnosy: +Arfrever
2015-05-02 20:36:29serhiy.storchakalinkissue24093 superseder
2015-05-02 20:36:24serhiy.storchakalinkissue24092 superseder
2015-05-02 20:34:44serhiy.storchakasetfiles: +etree_crashes.patch
versions: + Python 3.5
messages: +msg242430

assignee:serhiy.storchaka
keywords: +patch
stage: patch review
2015-05-01 14:12:23christian.heimessetnosy: +christian.heimes
2015-05-01 14:00:46serhiy.storchakasetnosy: +scoder,eli.bendersky,serhiy.storchaka
components: + Extension Modules, XML
2015-05-01 13:56:07pktcreate
Supported byThe Python Software Foundation,
Powered byRoundup
Copyright © 1990-2022,Python Software Foundation
Legal Statements

[8]ページ先頭

©2009-2026 Movatter.jp