Fix for SF bug [ #443866 ] Evaluating func_code causing core dump

If the code object has free variables, raise TypeError.

diff --git a/Python/bltinmodule.c b/Python/bltinmodule.c
index 6eb6acae56f1dd03735faa62f4ab413ee364c6d3..362cdaa2787dd234a09754d095647a73d03d056a 100644 (file)
--- a/Python/bltinmodule.c
+++ b/Python/bltinmodule.c
@@ -800,8 +800,14 @@ builtin_eval(PyObject *self, PyObject *args)
                                         PyEval_GetBuiltins()) != 0)
                        return NULL;
        }
-       if (PyCode_Check(cmd))
+       if (PyCode_Check(cmd)) {
+               if (PyTuple_GET_SIZE(((PyCodeObject *)cmd)->co_freevars) > 0) {
+                       PyErr_SetString(PyExc_TypeError,
+               "code object passed to eval() may not contain free variables");
+                       return NULL;
+               }
                return PyEval_EvalCode((PyCodeObject *) cmd, globals, locals);
+       }
        if (!PyString_Check(cmd) &&
            !PyUnicode_Check(cmd)) {
                PyErr_SetString(PyExc_TypeError,