cpython: 9a4db1ac5e10 (original) (raw)

Mercurial > cpython

changeset 99341:9a4db1ac5e10 2.7

Issue #25725: Fixed a reference leak in cPickle.loads() when unpickling invalid data including tuple instructions. [#25725]

Serhiy Storchaka storchaka@gmail.com
date	Wed, 25 Nov 2015 15:07:49 +0200
parents	a365fb0dd5e1
children	37158c067b25
files	Misc/NEWS Modules/cPickle.c
diffstat	2 files changed, 15 insertions(+), 21 deletions(-)[+] [-] Misc/NEWS 3 Modules/cPickle.c 33

line wrap: on

line diff

--- a/Misc/NEWS +++ b/Misc/NEWS @@ -13,6 +13,9 @@ Core and Builtins Library ------- +- Issue #25725: Fixed a reference leak in cPickle.loads() when unpickling

invalid data including tuple instructions. +

Issue #25663: In the Readline completer, avoid listing duplicate global names, and search the global namespace before searching builtins.

--- a/Modules/cPickle.c +++ b/Modules/cPickle.c @@ -3798,35 +3798,26 @@ load_binunicode(Unpicklerobject *self) static int -load_tuple(Unpicklerobject *self) +load_counted_tuple(Unpicklerobject *self, int len) { PyObject *tup;

Py_ssize_t i;

if ((i = marker(self)) < 0) return -1;
if (!( tup=Pdata_popTuple(self->stack, i))) return -1;

if (self->stack->length < len)
```
   return stackUnderflow();[](#l2.17)
```

if (!(tup = Pdata_popTuple(self->stack, self->stack->length - len)))
```
   return -1;[](#l2.20)
```
PDATA_PUSH(self->stack, tup, -1); return 0; } static int -load_counted_tuple(Unpicklerobject *self, int len) +load_tuple(Unpicklerobject *self) {

PyObject *tup = PyTuple_New(len);

if (tup == NULL)
```
   return -1;[](#l2.32)
```

while (--len >= 0) {
```
   PyObject *element;[](#l2.35)
```

   PDATA_POP(self->stack, element);[](#l2.37)

```
   if (element == NULL)[](#l2.38)
```
```
       return -1;[](#l2.39)
```

   PyTuple_SET_ITEM(tup, len, element);[](#l2.40)

}
PDATA_PUSH(self->stack, tup, -1);
return 0;

Py_ssize_t i;

if ((i = marker(self)) < 0) return -1;
return load_counted_tuple(self, self->stack->length - i);

} static int