This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author christian.heimes
Recipients christian.heimes
Date 2013-07-01.12:12:33
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <1372680753.86.0.0895011260211.issue18339@psf.upfronthosting.co.za>
In-reply-to
Content
Unpickler_set_memo() crashes when the unpickler's memo attribute is set to a dict with negative numbers. The descriptor uses _Unpickler_MemoPut() which uses the dict key as index to a C array.

Python 3.3.0 (v3.3.0:bd8afb90ebf2, Feb  8 2013, 00:38:29) 
[GCC 4.7.2] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import sys, pickle
>>> p = pickle.Unpickler(sys.stdin)
>>> p.memo = {-1: None}
segfault

The issue was found be Coverity Scan:

CID 486776 (#1 of 1): Improper use of negative value (NEGATIVE_RETURNS)
negative_returns: Passing variable "idx" to a parameter that cannot be negative.
5955            if (_Unpickler_MemoPut(self, idx, value) < 0)
History
Date User Action Args
2013-07-01 12:12:33christian.heimessetrecipients: + christian.heimes
2013-07-01 12:12:33christian.heimessetmessageid: <1372680753.86.0.0895011260211.issue18339@psf.upfronthosting.co.za>
2013-07-01 12:12:33christian.heimeslinkissue18339 messages
2013-07-01 12:12:33christian.heimescreate