classification
Title: ms.key_compare is not initialized in all paths of list_sort_impl()
Type: crash Stage: resolved
Components: Interpreter Core Versions: Python 3.8, Python 3.7
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: serhiy.storchaka Nosy List: ZackerySpytz, elliot.gorokhovsky, johnchen902, miss-islington, rhettinger, serhiy.storchaka
Priority: normal Keywords: patch

Created on 2018-06-28 17:43 by johnchen902, last changed 2019-02-21 08:14 by serhiy.storchaka. This issue is now closed.

Pull Requests
URL Status Linked Edit
PR 8710 merged ZackerySpytz, 2018-08-09 03:00
PR 11970 merged miss-islington, 2019-02-21 07:47
Messages (6)
msg320679 - (view) Author: Pochang Chen (johnchen902) * Date: 2018-06-28 17:43
Relevant code (Objects/listobject.c lines 2268 -- 2286 as of commit e76ac9d):

        /* Choose the best compare, given what we now know about the keys. */
        if (keys_are_all_same_type) {

            if (key_type == &PyUnicode_Type && strings_are_latin) {
                ms.key_compare = unsafe_latin_compare;
            }
            else if (key_type == &PyLong_Type && ints_are_bounded) {
                ms.key_compare = unsafe_long_compare;
            }
            else if (key_type == &PyFloat_Type) {
                ms.key_compare = unsafe_float_compare;
            }
            else if ((ms.key_richcompare = key_type->tp_richcompare) != NULL) {
                ms.key_compare = unsafe_object_compare;
            }
        }
        else {
            ms.key_compare = safe_object_compare;
        }

Clearly, ms.key_compare is not assigned here if keys_are_all_same_type is true but key_type->tp_richcompare is NULL.

I don't know how to obtain an object with ob_type->tp_richcompare being NULL, though.
msg320749 - (view) Author: Raymond Hettinger (rhettinger) * (Python committer) Date: 2018-06-30 00:53
Do you want to submit a patch?
msg320751 - (view) Author: Raymond Hettinger (rhettinger) * (Python committer) Date: 2018-06-30 01:33
Serhiy, do you want to take this one?
msg320752 - (view) Author: Elliot Gorokhovsky (elliot.gorokhovsky) * Date: 2018-06-30 05:22
You can always fall back on safe_object_compare. So unless there's an
obvious reason why your edge case can't be triggered, it would be worth
putting that in as a failsafe. The additional branch should be 100%
predictable, so there shouldn't be any performance penalty.
msg336188 - (view) Author: Serhiy Storchaka (serhiy.storchaka) * (Python committer) Date: 2019-02-21 07:47
New changeset ebc793d6acb9650b9f497808e059805892031d74 by Serhiy Storchaka (Zackery Spytz) in branch 'master':
bpo-33989: Ensure that ms.key_compare is always initialized in list_sort_impl(). (GH-8710)
https://github.com/python/cpython/commit/ebc793d6acb9650b9f497808e059805892031d74
msg336189 - (view) Author: miss-islington (miss-islington) Date: 2019-02-21 08:05
New changeset 0e73ea26a55abc0ce2ee1153e5509bcaef4736cf by Miss Islington (bot) in branch '3.7':
bpo-33989: Ensure that ms.key_compare is always initialized in list_sort_impl(). (GH-8710)
https://github.com/python/cpython/commit/0e73ea26a55abc0ce2ee1153e5509bcaef4736cf
History
Date User Action Args
2019-02-21 08:14:44serhiy.storchakasetstatus: open -> closed
resolution: fixed
stage: patch review -> resolved
2019-02-21 08:05:26miss-islingtonsetnosy: + miss-islington
messages: + msg336189
2019-02-21 07:47:27miss-islingtonsetpull_requests: + pull_request11996
2019-02-21 07:47:17serhiy.storchakasetmessages: + msg336188
2018-08-09 03:00:00ZackerySpytzsetkeywords: + patch
stage: patch review
pull_requests: + pull_request8197
2018-08-09 02:59:44ZackerySpytzsetnosy: + ZackerySpytz

title: ms.key_compare is not initialized in all pathes of list_sort_impl -> ms.key_compare is not initialized in all paths of list_sort_impl()
2018-06-30 05:22:59elliot.gorokhovskysetmessages: + msg320752
2018-06-30 05:08:30serhiy.storchakasetnosy: + elliot.gorokhovsky
2018-06-30 01:33:39rhettingersetassignee: serhiy.storchaka

messages: + msg320751
nosy: + serhiy.storchaka
2018-06-30 00:53:06rhettingersetnosy: + rhettinger
messages: + msg320749
2018-06-28 17:43:06johnchen902create