Commitd639438

authored

gh-97591: InException.__setstate__() acquire strong references before callingtp_hash slot (#97700)

1 parent8baef8a commitd639438Copy full SHA for d639438

File tree

+34

-1

lines changed

+34

-1

lines changed

Lines changed: 25 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -114,6 +114,31 @@ def test_interface_no_arg(self):`
`114`	`114`	`[repr(exc),exc.__class__.__name__+'()'])`
`115`	`115`	`self.interface_test_driver(results)`
`116`	`116`
	`117`	`+deftest_setstate_refcount_no_crash(self):`
	`118`	`+# gh-97591: Acquire strong reference before calling tp_hash slot`
	`119`	`+# in PyObject_SetAttr.`
	`120`	`+importgc`
	`121`	`+d= {}`
	`122`	`+classHashThisKeyWillClearTheDict(str):`
	`123`	`+def__hash__(self)->int:`
	`124`	`+d.clear()`
	`125`	`+returnsuper().__hash__()`
	`126`	`+classValue(str):`
	`127`	`+pass`
	`128`	`+exc=Exception()`
	`129`	`+`
	`130`	`+d[HashThisKeyWillClearTheDict()]=Value()# refcount of Value() is 1 now`
	`131`	`+`
	`132`	`+# Exception.__setstate__ should aquire a strong reference of key and`
	`133`	`+# value in the dict. Otherwise, Value()'s refcount would go below`
	`134`	`+# zero in the tp_hash call in PyObject_SetAttr(), and it would cause`
	`135`	`+# crash in GC.`
	`136`	`+exc.__setstate__(d)# __hash__() is called again here, clearing the dict.`
	`137`	`+`
	`138`	`+# This GC would crash if the refcount of Value() goes below zero.`
	`139`	`+gc.collect()`
	`140`	`+`
	`141`	`+`
`117`	`142`	`classUsageTests(unittest.TestCase):`
`118`	`143`
`119`	`144`	`"""Test usage of exceptions"""`

Lines changed: 2 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	+Fixed a missing incref/decref pair in `Exception.__setstate__()`.
	`2`	`+Patch by Ofey Chan.`

Lines changed: 7 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -167,8 +167,14 @@ BaseException_setstate(PyObject self, PyObject state)`
`167`	`167`	`returnNULL;`
`168`	`168`	`}`
`169`	`169`	`while (PyDict_Next(state,&i,&d_key,&d_value)) {`
`170`		`-if (PyObject_SetAttr(self,d_key,d_value)<0)`
	`170`	`+Py_INCREF(d_key);`
	`171`	`+Py_INCREF(d_value);`
	`172`	`+intres=PyObject_SetAttr(self,d_key,d_value);`
	`173`	`+Py_DECREF(d_value);`
	`174`	`+Py_DECREF(d_key);`
	`175`	`+if (res<0) {`
`171`	`176`	`returnNULL;`
	`177`	`+ }`
`172`	`178`	`}`
`173`	`179`	`}`
`174`	`180`	`Py_RETURN_NONE;`

Comments

(0)