Commitc6fcbb4

and

authored

gh-97591: InException.__setstate__() acquire strong references before callingtp_hash slot (GH-97700)

(cherry picked from commitd639438)Co-authored-by: Ofey Chan <ofey206@gmail.com>

1 parenta4fbb94 commitc6fcbb4Copy full SHA for c6fcbb4

File tree

+34

-1

lines changed

+34

-1

lines changed

Lines changed: 25 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -114,6 +114,31 @@ def test_interface_no_arg(self):`
`114`	`114`	`[repr(exc),exc.__class__.__name__+'()'])`
`115`	`115`	`self.interface_test_driver(results)`
`116`	`116`
	`117`	`+deftest_setstate_refcount_no_crash(self):`
	`118`	`+# gh-97591: Acquire strong reference before calling tp_hash slot`
	`119`	`+# in PyObject_SetAttr.`
	`120`	`+importgc`
	`121`	`+d= {}`
	`122`	`+classHashThisKeyWillClearTheDict(str):`
	`123`	`+def__hash__(self)->int:`
	`124`	`+d.clear()`
	`125`	`+returnsuper().__hash__()`
	`126`	`+classValue(str):`
	`127`	`+pass`
	`128`	`+exc=Exception()`
	`129`	`+`
	`130`	`+d[HashThisKeyWillClearTheDict()]=Value()# refcount of Value() is 1 now`
	`131`	`+`
	`132`	`+# Exception.__setstate__ should aquire a strong reference of key and`
	`133`	`+# value in the dict. Otherwise, Value()'s refcount would go below`
	`134`	`+# zero in the tp_hash call in PyObject_SetAttr(), and it would cause`
	`135`	`+# crash in GC.`
	`136`	`+exc.__setstate__(d)# __hash__() is called again here, clearing the dict.`
	`137`	`+`
	`138`	`+# This GC would crash if the refcount of Value() goes below zero.`
	`139`	`+gc.collect()`
	`140`	`+`
	`141`	`+`
`117`	`142`	`classUsageTests(unittest.TestCase):`
`118`	`143`
`119`	`144`	`"""Test usage of exceptions"""`

Lines changed: 2 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	+Fixed a missing incref/decref pair in `Exception.__setstate__()`.
	`2`	`+Patch by Ofey Chan.`

Lines changed: 7 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -156,8 +156,14 @@ BaseException_setstate(PyObject self, PyObject state)`
`156`	`156`	`returnNULL;`
`157`	`157`	`}`
`158`	`158`	`while (PyDict_Next(state,&i,&d_key,&d_value)) {`
`159`		`-if (PyObject_SetAttr(self,d_key,d_value)<0)`
	`159`	`+Py_INCREF(d_key);`
	`160`	`+Py_INCREF(d_value);`
	`161`	`+intres=PyObject_SetAttr(self,d_key,d_value);`
	`162`	`+Py_DECREF(d_value);`
	`163`	`+Py_DECREF(d_key);`
	`164`	`+if (res<0) {`
`160`	`165`	`returnNULL;`
	`166`	`+ }`
`161`	`167`	`}`
`162`	`168`	`}`
`163`	`169`	`Py_RETURN_NONE;`

Comments

(0)