Fix for

[ 784825 ] fix obscure crash in descriptor handling

Should be applied to release23-maint and in all likelyhood
release22-maint, too.

Certainly doesn't apply to release21-maint.

diff --git a/Lib/test/test_descr.py b/Lib/test/test_descr.py
index b3336d1fc8d784f53714dee8cc0c4395caff28eb..e001562f971e2da79474153e77d3464160237fca 100644 (file)
--- a/Lib/test/test_descr.py
+++ b/Lib/test/test_descr.py
@@ -3938,6 +3938,36 @@ def filefault():
     except RuntimeError:
         pass
 
+def vicious_descriptor_nonsense():
+    # A potential segfault spotted by Thomas Wouters in mail to
+    # python-dev 2003-04-17, turned into an example & fixed by Michael
+    # Hudson just less than four months later...
+    if verbose:
+        print "Testing vicious_descriptor_nonsense..."
+
+    class Evil(object):
+        def __hash__(self):
+            return hash('attr')
+        def __eq__(self, other):
+            del C.attr
+            return 0
+
+    class Descr(object):
+        def __get__(self, ob, type=None):
+            return 1
+
+    class C(object):
+        attr = Descr()
+
+    c = C()
+    c.__dict__[Evil()] = 0
+
+    vereq(c.attr, 1)
+    # this makes a crash more likely:
+    import gc; gc.collect()
+    vereq(hasattr(c, 'attr'), False)
+    
+
 def test_main():
     weakref_segfault() # Must be first, somehow
     do_this_first()
@@ -4029,6 +4059,7 @@ def test_main():
     proxysuper()
     carloverre()
     filefault()
+    vicious_descriptor_nonsense()
 
     if verbose: print "All OK"
 

diff --git a/Objects/object.c b/Objects/object.c
index 93057c06946b84fe84df8eabae39fcec44c99273..8c4bd0ef6742b44341b35c4a27c6955418c2f585 100644 (file)
--- a/Objects/object.c
+++ b/Objects/object.c
@@ -1412,12 +1412,15 @@ PyObject_GenericGetAttr(PyObject *obj, PyObject *name)
                }
        }
 
+       Py_XINCREF(descr);
+
        f = NULL;
        if (descr != NULL &&
            PyType_HasFeature(descr->ob_type, Py_TPFLAGS_HAVE_CLASS)) {
                f = descr->ob_type->tp_descr_get;
                if (f != NULL && PyDescr_IsData(descr)) {
                        res = f(descr, obj, (PyObject *)obj->ob_type);
+                       Py_DECREF(descr);
                        goto done;
                }
        }
@@ -1445,6 +1448,7 @@ PyObject_GenericGetAttr(PyObject *obj, PyObject *name)
                        res = PyDict_GetItem(dict, name);
                        if (res != NULL) {
                                Py_INCREF(res);
+                               Py_XDECREF(descr);
                                goto done;
                        }
                }
@@ -1452,12 +1456,13 @@ PyObject_GenericGetAttr(PyObject *obj, PyObject *name)
 
        if (f != NULL) {
                res = f(descr, obj, (PyObject *)obj->ob_type);
+               Py_DECREF(descr);
                goto done;
        }
 
        if (descr != NULL) {
-               Py_INCREF(descr);
                res = descr;
+               /* descr was already increfed above */
                goto done;
        }
 

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 5c0f73aef6b48fad56c5db719ecdf9999faf3690..af255f156aaa3d6a4c3a75aa2f7ff2a93467d37a 100644 (file)
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -2010,6 +2010,7 @@ type_getattro(PyTypeObject *type, PyObject *name)
                        return meta_get(meta_attribute, (PyObject *)type,
                                        (PyObject *)metatype);
                }
+               Py_INCREF(meta_attribute);
        }
 
        /* No data descriptor found on metatype. Look in tp_dict of this
@@ -2018,6 +2019,9 @@ type_getattro(PyTypeObject *type, PyObject *name)
        if (attribute != NULL) {
                /* Implement descriptor functionality, if any */
                descrgetfunc local_get = attribute->ob_type->tp_descr_get;
+
+               Py_XDECREF(meta_attribute);
+
                if (local_get != NULL) {
                        /* NULL 2nd argument indicates the descriptor was
                         * found on the target object itself (or a base)  */
@@ -2031,13 +2035,16 @@ type_getattro(PyTypeObject *type, PyObject *name)
 
        /* No attribute found in local __dict__ (or bases): use the
         * descriptor from the metatype, if any */
-       if (meta_get != NULL)
-               return meta_get(meta_attribute, (PyObject *)type,
-                               (PyObject *)metatype);
+       if (meta_get != NULL) {
+               PyObject *res;
+               res = meta_get(meta_attribute, (PyObject *)type,
+                              (PyObject *)metatype);
+               Py_DECREF(meta_attribute);
+               return res;
+       }
 
        /* If an ordinary attribute was found on the metatype, return it now */
        if (meta_attribute != NULL) {
-               Py_INCREF(meta_attribute);
                return meta_attribute;
        }