classification
Title: ms.key_compare is not initialized in all paths of list_sort_impl()
Type: crash Stage: patch review
Components: Interpreter Core Versions: Python 3.8, Python 3.7
process
Status: open Resolution:
Dependencies: Superseder:
Assigned To: serhiy.storchaka Nosy List: ZackerySpytz, elliot.gorokhovsky, johnchen902, rhettinger, serhiy.storchaka
Priority: normal Keywords: patch

Created on 2018-06-28 17:43 by johnchen902, last changed 2018-08-09 03:00 by ZackerySpytz.

Pull Requests
URL Status Linked Edit
PR 8710 open ZackerySpytz, 2018-08-09 03:00
Messages (4)
msg320679 - (view) Author: Pochang Chen (johnchen902) * Date: 2018-06-28 17:43
Relevant code (Objects/listobject.c lines 2268 -- 2286 as of commit e76ac9d):

        /* Choose the best compare, given what we now know about the keys. */
        if (keys_are_all_same_type) {

            if (key_type == &PyUnicode_Type && strings_are_latin) {
                ms.key_compare = unsafe_latin_compare;
            }
            else if (key_type == &PyLong_Type && ints_are_bounded) {
                ms.key_compare = unsafe_long_compare;
            }
            else if (key_type == &PyFloat_Type) {
                ms.key_compare = unsafe_float_compare;
            }
            else if ((ms.key_richcompare = key_type->tp_richcompare) != NULL) {
                ms.key_compare = unsafe_object_compare;
            }
        }
        else {
            ms.key_compare = safe_object_compare;
        }

Clearly, ms.key_compare is not assigned here if keys_are_all_same_type is true but key_type->tp_richcompare is NULL.

I don't know how to obtain an object with ob_type->tp_richcompare being NULL, though.
msg320749 - (view) Author: Raymond Hettinger (rhettinger) * (Python committer) Date: 2018-06-30 00:53
Do you want to submit a patch?
msg320751 - (view) Author: Raymond Hettinger (rhettinger) * (Python committer) Date: 2018-06-30 01:33
Serhiy, do you want to take this one?
msg320752 - (view) Author: Elliot Gorokhovsky (elliot.gorokhovsky) * Date: 2018-06-30 05:22
You can always fall back on safe_object_compare. So unless there's an
obvious reason why your edge case can't be triggered, it would be worth
putting that in as a failsafe. The additional branch should be 100%
predictable, so there shouldn't be any performance penalty.
History
Date User Action Args
2018-08-09 03:00:00ZackerySpytzsetkeywords: + patch
stage: patch review
pull_requests: + pull_request8197
2018-08-09 02:59:44ZackerySpytzsetnosy: + ZackerySpytz

title: ms.key_compare is not initialized in all pathes of list_sort_impl -> ms.key_compare is not initialized in all paths of list_sort_impl()
2018-06-30 05:22:59elliot.gorokhovskysetmessages: + msg320752
2018-06-30 05:08:30serhiy.storchakasetnosy: + elliot.gorokhovsky
2018-06-30 01:33:39rhettingersetassignee: serhiy.storchaka

messages: + msg320751
nosy: + serhiy.storchaka
2018-06-30 00:53:06rhettingersetnosy: + rhettinger
messages: + msg320749
2018-06-28 17:43:06johnchen902create