Crash due to borrowed references in _PyStack_UnpackDict() #81088
Comments
class IntWithDict:
def __init__(self, **kwargs):
self.kwargs = kwargs
def __index__(self):
self.kwargs.clear()
L = [2**i for i in range(10000)]
return 0
x = IntWithDict(dont_inherit=float())
compile("", "", "", x, **x.kwargs)The above crashes CPython due to the usage of borrowed references in _PyStack_UnpackDict(): the dict x.kwargs contains the only reference to the float() object stored in x.kwargs When parsing the arguments, x.__int__() is called, which clears the dict, removing the only reference to that float() |
jdemeyer
added
3.7 (EOL)
|
Ideally, this would be fixed together with bpo-36904. |
|
The idea of bpo-36904 could be used here: define a special kind of tuple, which is like an ordinary tuple followed by a C array of PyObject* entries (all refcounted), terminated by a NULL to know where it ends. A special deallocation function would decref all entries. |
|
Jeroen, do you want to also do a backport for 3.7? |
Don't we have a bot for that? |
|
We do, but here the test will need to be changed: Python 3.7.3+ (heads/3.7:791e5fcbab, May 22 2019, 13:37:27)
[GCC 9.1.1 20190503 (Red Hat 9.1.1-1)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> class IntWithDict:
... def __init__(self, **kwargs):
... self.kwargs = kwargs
... def __index__(self):
... self.kwargs.clear()
... return 0
...
>>> x = IntWithDict(dont_inherit=float())
>>> compile("", "", "", x, **x.kwargs)
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
TypeError: an integer is required (got type IntWithDict) |
|
Using __int__ instead of __index__ works. PR coming right away. |
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
bugs.python.org fields:
The text was updated successfully, but these errors were encountered: