Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork33.3k
Closed
Assignees
Description
Crash report
What happened?
classEvil(str):def__str__(self):delexc.objectreturn'evil'exc=UnicodeEncodeError(Evil(),"object",0,0,Evil())str(exc)
results inSegmentation fault (core dumped). Another possibility for a crash:
classEvil(str):def__str__(self):delexc.objectreturn'evil'exc=UnicodeEncodeError(Evil(),"object",0,0,Evil())str(exc)
results in
python: ./Include/cpython/unicodeobject.h:286: PyUnicode_GET_LENGTH: Assertion `PyUnicode_Check(op)' failed.Aborted (core dumped)The segmentation fault is quite easy to fix:
reason_str=PyObject_Str(exc->reason);if (reason_str==NULL) { gotodone;}encoding_str=PyObject_Str(exc->encoding);if (encoding_str==NULL) { gotodone;}Py_ssize_tlen=PyUnicode_GET_LENGTH(exc->object);
It occurs inPyUnicode_GET_LENGTH(exc->object);. And the reason is thatPyObject_Str(...) may call artrbitary code.
I have a PR ready that I will post soon.
See#128975 (comment) for the rationale of not backporting it.
CPython versions tested on:
CPython main branch