classification
Title: possible segfault in math.factorial
Type: crash Stage: commit review
Components: Extension Modules Versions: Python 3.4, Python 3.2, Python 3.3
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: mark.dickinson Nosy List: amaury.forgeotdarc, benjamin.peterson, mark.dickinson, python-dev, rhettinger, serhiy.storchaka
Priority: high Keywords: patch

Created on 2012-10-23 22:33 by amaury.forgeotdarc, last changed 2014-04-08 14:55 by benjamin.peterson. This issue is now closed.

Files
File name Uploaded Description Edit
fix_factorial_segfault.patch mark.dickinson, 2012-10-24 10:51 review
Messages (8)
msg173643 - (view) Author: Amaury Forgeot d'Arc (amaury.forgeotdarc) * (Python committer) Date: 2012-10-23 22:33
>>> import math, sys
>>> math.factorial(sys.maxsize - 1)
(Hit Ctrl-C)
Segmentation fault

The cause is probably in mathmodule.c::factorial_odd_part():
  error:
    Py_DECREF(outer);
  done:
    Py_DECREF(inner);
    return outer;
In case of error, the function returns a released reference instead of NULL.
msg173654 - (view) Author: Mark Dickinson (mark.dickinson) * (Python committer) Date: 2012-10-24 07:58
I can reproduce this on 3.2 (OS X).  I'll take a look tonight.
msg173666 - (view) Author: Mark Dickinson (mark.dickinson) * (Python committer) Date: 2012-10-24 10:51
Here's a patch.
msg173680 - (view) Author: Serhiy Storchaka (serhiy.storchaka) * (Python committer) Date: 2012-10-24 13:07
LGTM.
msg173751 - (view) Author: Roundup Robot (python-dev) Date: 2012-10-25 09:52
New changeset 19ed42e84030 by Mark Dickinson in branch '3.3':
Issue #16305: Merge fix from 3.2.
http://hg.python.org/cpython/rev/19ed42e84030

New changeset cbdd6852a274 by Mark Dickinson in branch 'default':
Issue #16305: Merge fix from 3.3.
http://hg.python.org/cpython/rev/cbdd6852a274
msg173753 - (view) Author: Mark Dickinson (mark.dickinson) * (Python committer) Date: 2012-10-25 10:33
Fixed in 3.2, 3.3 and default.  Thanks Amaury for the report and diagnosis!

(I forget to add the issue number in the 3.2 commit:  the changeset is b4bfcf7a4773.)
msg215764 - (view) Author: Roundup Robot (python-dev) Date: 2014-04-08 14:51
New changeset 3016a9e8061a by Benjamin Peterson in branch '2.7':
PySequence_Fast generally returns a list (#16305)
http://hg.python.org/cpython/rev/3016a9e8061a
msg215765 - (view) Author: Benjamin Peterson (benjamin.peterson) * (Python committer) Date: 2014-04-08 14:55
(Obviously that last message should have gone to #16395 instead.)
History
Date User Action Args
2014-04-08 14:55:26benjamin.petersonsetnosy: + benjamin.peterson
messages: + msg215765
2014-04-08 14:51:02python-devsetmessages: + msg215764
2012-10-25 10:33:20mark.dickinsonsetstatus: open -> closed
resolution: fixed
messages: + msg173753
2012-10-25 09:52:24python-devsetnosy: + python-dev
messages: + msg173751
2012-10-24 13:07:38serhiy.storchakasetnosy: + serhiy.storchaka
messages: + msg173680
2012-10-24 10:51:09mark.dickinsonsetfiles: + fix_factorial_segfault.patch
keywords: + patch
messages: + msg173666

stage: needs patch -> commit review
2012-10-24 07:58:42mark.dickinsonsetversions: + Python 3.4
2012-10-24 07:58:06mark.dickinsonsetpriority: normal -> high
messages: + msg173654

assignee: mark.dickinson
components: + Extension Modules
stage: needs patch
2012-10-23 23:09:02pitrousetnosy: + rhettinger, mark.dickinson
2012-10-23 22:33:28amaury.forgeotdarccreate