classification
Title: cElementTree: replace PyObject_DEL() by Py_DECREF() to fix a crash in pydebug mode
Type: crash Stage: patch review
Components: Extension Modules, XML Versions: Python 3.1, Python 3.2, Python 2.7
process
Status: closed Resolution: wont fix
Dependencies: Superseder:
Assigned To: Nosy List: effbot, flox, pitrou, vstinner
Priority: normal Keywords: patch

Created on 2010-07-28 20:58 by vstinner, last changed 2012-04-16 00:11 by vstinner. This issue is now closed.

Files
File name Uploaded Description Edit
celementtree_py_decref.patch vstinner, 2010-07-28 20:58
Messages (3)
msg111846 - (view) Author: STINNER Victor (vstinner) * (Python committer) Date: 2010-07-28 20:58
PyObject_DEL() should not be used to destroy an object because it will break the linked list of allocated objects, list used in pydebug mode to detect bugs. cElementTree should use Py_DECREF() instead of PyObject_DEL() to destroy an objects.

Attached patch fixes that:
 * Replace PyObject_Del() by Py_DECREF()
 * Catch element_new_extra() errors
 * parser dealloc: replace Py_DECREF() by Py_XDECREF() because the pointer may be NULL (error in the constructor)
 * set all parser attributes to NULL at the beginning of the constructor to be able to call safetly the destructor
 * element_new(): define tag, text, tail attributes before calling element_new_extra() to be able to call the destructor
 * raise a MemoryError on element_new_extra() failure. element_new() didn't raise any error on element_new_extra() failure. Other functions just forget to catch element_new_extra() error.

See #3299 for the whole story.
msg112776 - (view) Author: Antoine Pitrou (pitrou) * (Python committer) Date: 2010-08-04 09:25
Looks reasonable. Are there any tests that could be easily added to the test suite?
msg113737 - (view) Author: STINNER Victor (vstinner) * (Python committer) Date: 2010-08-13 01:34
> Are there any tests that could be easily added to the test suite?

I don't know an easy way to simulate malloc failure. There is the http://www.nongnu.org/failmalloc/ library but I never used it, and I don't think that it's widely used. You can just test that the patch doesn't make things worse :-)
History
Date User Action Args
2012-04-16 00:11:32vstinnersetstatus: open -> closed
resolution: wont fix
2010-08-13 01:34:39vstinnersetmessages: + msg113737
2010-08-04 09:25:25pitrousetnosy: + pitrou

messages: + msg112776
versions: + Python 3.1
2010-08-04 07:58:06floxsetstage: patch review
2010-08-04 07:56:22floxsetnosy: + effbot, flox
type: crash
components: + Extension Modules, XML, - Library (Lib)
2010-07-28 20:58:24vstinnercreate