classification
Title: crash with negative PUT in pickle
Type: crash Stage: resolved
Components: Versions: Python 3.2, Python 3.3
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: Nosy List: pitrou, python-dev
Priority: normal Keywords:

Created on 2011-08-27 12:01 by pitrou, last changed 2011-08-29 22:31 by pitrou. This issue is now closed.

Messages (3)
msg143062 - (view) Author: Antoine Pitrou (pitrou) * (Python committer) Date: 2011-08-27 12:01
This doesn't happen on 2.x cPickle, where PUT keys are simply treated as strings.

>>> import pickle, pickletools
>>> s = b'Va\np-1\n.'
>>> pickletools.dis(s)
    0: V    UNICODE    'a'
    3: p    PUT        -1
    7: .    STOP
highest protocol among opcodes = 0
>>> pickle.loads(s)   
Erreur de segmentation
msg143063 - (view) Author: Antoine Pitrou (pitrou) * (Python committer) Date: 2011-08-27 12:05
Same with LONG_BINPUT on a 32-bit build:

>>> s = b'\x80\x03X\x01\x00\x00\x00ar\xff\xff\xff\xff.'
>>> pickletools.dis(s)
    0: \x80 PROTO      3
    2: X    BINUNICODE 'a'
    8: r    LONG_BINPUT -1
   13: .    STOP
highest protocol among opcodes = 2
>>> pickle.loads(s)
Erreur de segmentation
msg143190 - (view) Author: Roundup Robot (python-dev) Date: 2011-08-29 22:31
New changeset 0d9e4ce1c010 by Antoine Pitrou in branch '3.2':
Issue #12847: Fix a crash with negative PUT and LONG_BINPUT arguments in
http://hg.python.org/cpython/rev/0d9e4ce1c010

New changeset fb8d7a666bed by Antoine Pitrou in branch 'default':
Issue #12847: Fix a crash with negative PUT and LONG_BINPUT arguments in
http://hg.python.org/cpython/rev/fb8d7a666bed
History
Date User Action Args
2011-08-29 22:31:35pitrousetstatus: open -> closed
resolution: fixed
stage: resolved
2011-08-29 22:31:14python-devsetnosy: + python-dev
messages: + msg143190
2011-08-27 12:05:46pitrousetmessages: + msg143063
2011-08-27 12:01:04pitroucreate