(original) (raw)

changeset: 82458:0e41c4466d58 branch: 2.7 parent: 82446:2f500533e9b9 user: Mark Dickinson dickinsm@gmail.com date: Sun Mar 03 11:13:34 2013 +0000 files: Lib/test/test_exceptions.py Misc/NEWS Objects/exceptions.c description: Issue #16445: Fix potential segmentation fault when deleting an exception message. diff -r 2f500533e9b9 -r 0e41c4466d58 Lib/test/test_exceptions.py --- a/Lib/test/test_exceptions.py Fri Mar 01 21:26:04 2013 +0200 +++ b/Lib/test/test_exceptions.py Sun Mar 03 11:13:34 2013 +0000 @@ -479,6 +479,18 @@ except AssertionError as e: self.assertEqual(str(e), "(3,)") + def test_bad_exception_clearing(self): + # See issue 16445: use of Py_XDECREF instead of Py_CLEAR in + # BaseException_set_message gave a possible way to segfault the + # interpreter. + class Nasty(str): + def __del__(message): + del e.message + + e = ValueError(Nasty("msg")) + e.args = () + del e.message + # Helper class used by TestSameStrAndUnicodeMsg class ExcWithOverriddenStr(Exception): diff -r 2f500533e9b9 -r 0e41c4466d58 Misc/NEWS --- a/Misc/NEWS Fri Mar 01 21:26:04 2013 +0200 +++ b/Misc/NEWS Sun Mar 03 11:13:34 2013 +0000 @@ -9,6 +9,9 @@ Core and Builtins ----------------- +- Issue #16445: Fixed potential segmentation fault when deleting an exception + message. + - Issue #17275: Corrected class name in init error messages of the C version of BufferedWriter and BufferedRandom. diff -r 2f500533e9b9 -r 0e41c4466d58 Objects/exceptions.c --- a/Objects/exceptions.c Fri Mar 01 21:26:04 2013 +0200 +++ b/Objects/exceptions.c Sun Mar 03 11:13:34 2013 +0000 @@ -349,8 +349,7 @@ if (PyDict_DelItemString(self->dict, "message") < 0) return -1; } - Py_XDECREF(self->message); - self->message = NULL; + Py_CLEAR(self->message); return 0; } /dickinsm@gmail.com