From: Serhiy Storchaka <storchaka@gmail.com>
Date: Fri, 7 Oct 2016 18:55:49 +0000 (+0300)
Subject: Issue #24098: Fixed possible crash when AST is changed in process of
X-Git-Tag: v3.6.0b2~35
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=5e80855af3537f9715b33539d5b9860ca533a288;p=python

Issue #24098: Fixed possible crash when AST is changed in process of
compiling it.
---

5e80855af3537f9715b33539d5b9860ca533a288
diff --cc Misc/NEWS
index b03cc817f7,369aa8b03f..2edec5ee59
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@@ -10,9 -10,9 +10,12 @@@ What's New in Python 3.6.0 beta 
  Core and Builtins
  -----------------
  
+ - Issue #24098: Fixed possible crash when AST is changed in process of
+   compiling it.
+ 
 +- Issue #28201: Dict reduces possibility of 2nd conflict in hash table when
 +  hashes have same lower bits.
 +
  - Issue #28350: String constants with null character no longer interned.
  
  - Issue #26617: Fix crash when GC runs during weakref callbacks.
diff --cc Parser/asdl_c.py
index 17c85173f1,ac9d2b6346..725d73bad4
mode 100644,100755..100644
--- a/Parser/asdl_c.py
+++ b/Parser/asdl_c.py
diff --cc Python/Python-ast.c
index f10e315707,ad53ba3585..e0607ba9ae
--- a/Python/Python-ast.c
+++ b/Python/Python-ast.c
@@@ -6283,86 -6205,6 +6463,90 @@@ obj2ast_expr(PyObject* obj, expr_ty* ou
          if (*out == NULL) goto failed;
          return 0;
      }
 +    isinstance = PyObject_IsInstance(obj, (PyObject*)FormattedValue_type);
 +    if (isinstance == -1) {
 +        return 1;
 +    }
 +    if (isinstance) {
 +        expr_ty value;
 +        int conversion;
 +        expr_ty format_spec;
 +
 +        if (_PyObject_HasAttrId(obj, &PyId_value)) {
 +            int res;
 +            tmp = _PyObject_GetAttrId(obj, &PyId_value);
 +            if (tmp == NULL) goto failed;
 +            res = obj2ast_expr(tmp, &value, arena);
 +            if (res != 0) goto failed;
 +            Py_CLEAR(tmp);
 +        } else {
 +            PyErr_SetString(PyExc_TypeError, "required field \"value\" missing from FormattedValue");
 +            return 1;
 +        }
 +        if (exists_not_none(obj, &PyId_conversion)) {
 +            int res;
 +            tmp = _PyObject_GetAttrId(obj, &PyId_conversion);
 +            if (tmp == NULL) goto failed;
 +            res = obj2ast_int(tmp, &conversion, arena);
 +            if (res != 0) goto failed;
 +            Py_CLEAR(tmp);
 +        } else {
 +            conversion = 0;
 +        }
 +        if (exists_not_none(obj, &PyId_format_spec)) {
 +            int res;
 +            tmp = _PyObject_GetAttrId(obj, &PyId_format_spec);
 +            if (tmp == NULL) goto failed;
 +            res = obj2ast_expr(tmp, &format_spec, arena);
 +            if (res != 0) goto failed;
 +            Py_CLEAR(tmp);
 +        } else {
 +            format_spec = NULL;
 +        }
 +        *out = FormattedValue(value, conversion, format_spec, lineno,
 +                              col_offset, arena);
 +        if (*out == NULL) goto failed;
 +        return 0;
 +    }
 +    isinstance = PyObject_IsInstance(obj, (PyObject*)JoinedStr_type);
 +    if (isinstance == -1) {
 +        return 1;
 +    }
 +    if (isinstance) {
 +        asdl_seq* values;
 +
 +        if (_PyObject_HasAttrId(obj, &PyId_values)) {
 +            int res;
 +            Py_ssize_t len;
 +            Py_ssize_t i;
 +            tmp = _PyObject_GetAttrId(obj, &PyId_values);
 +            if (tmp == NULL) goto failed;
 +            if (!PyList_Check(tmp)) {
 +                PyErr_Format(PyExc_TypeError, "JoinedStr field \"values\" must be a list, not a %.200s", tmp->ob_type->tp_name);
 +                goto failed;
 +            }
 +            len = PyList_GET_SIZE(tmp);
 +            values = _Py_asdl_seq_new(len, arena);
 +            if (values == NULL) goto failed;
 +            for (i = 0; i < len; i++) {
 +                expr_ty value;
 +                res = obj2ast_expr(PyList_GET_ITEM(tmp, i), &value, arena);
 +                if (res != 0) goto failed;
++                if (len != PyList_GET_SIZE(tmp)) {
++                    PyErr_SetString(PyExc_RuntimeError, "JoinedStr field \"values\" changed size during iteration");
++                    goto failed;
++                }
 +                asdl_seq_SET(values, i, value);
 +            }
 +            Py_CLEAR(tmp);
 +        } else {
 +            PyErr_SetString(PyExc_TypeError, "required field \"values\" missing from JoinedStr");
 +            return 1;
 +        }
 +        *out = JoinedStr(values, lineno, col_offset, arena);
 +        if (*out == NULL) goto failed;
 +        return 0;
 +    }
      isinstance = PyObject_IsInstance(obj, (PyObject*)Bytes_type);
      if (isinstance == -1) {
          return 1;