-
-
Notifications
You must be signed in to change notification settings - Fork 29.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Multiple use after frees in obj2ast_* methods #68286
Comments
\bpo-3617 for (i = 0; i < len; i++) { This construct: for (i = 0; i < len; i++) {
stmt_ty value;
res = obj2ast_stmt(PyList_GET_ITEM(tmp, i), &value, arena);
if (res != 0) goto failed;
asdl_seq_SET(body, i, value);
} is repeated multiple times in multiple obj2ast_ methods. It contains two bugs:
|
ping |
3 similar comments
ping |
ping |
ping |
Fix by replacing static 'len' in loops with a macro, so that mutations of size of the containter do not casue OOB reads. |
Please note that Python/Python-ast.c is automatically generated by Parser/asdl_c.py. |
Bad things happen not only when a list shrinks, but also when it grows during iteration. The one solution is to check if the size is changed on every iteration. The other solution is to convert a list to a tuple for iterating. |
New changeset 47d5bf5a846f by Serhiy Storchaka in branch '2.7': New changeset f575710b5f56 by Serhiy Storchaka in branch '3.5': New changeset 7528154cadaa by Serhiy Storchaka in branch '3.6': New changeset def217aaad2f by Serhiy Storchaka in branch 'default': |
Misc/NEWS
so that it is managed by towncrier #552Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
bugs.python.org fields:
The text was updated successfully, but these errors were encountered: