mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-04 08:59:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

Issue #16228: Fix a crash in the json module where a list changes size while it is being encoded.

Browse source 
Patch by Serhiy Storchaka.
This commit is contained in:
Antoine Pitrou 2012-11-01 20:03:30 +01:00
commit 53d36b6912
3 changed files with 14 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

10
Modules/_json.c
View file

@ -1659,8 +1659,6 @@ encoder_listencode_list(PyEncoderObject *s, _PyAccu *acc,
static PyObject *empty_array = NULL;
PyObject *ident = NULL;
PyObject *s_fast = NULL;
Py_ssize_t num_items;
PyObject **seq_items;
Py_ssize_t i;
if (open_array == NULL || close_array == NULL || empty_array == NULL) {
@ -1674,8 +1672,7 @@ encoder_listencode_list(PyEncoderObject *s, _PyAccu *acc,
s_fast = PySequence_Fast(seq, "_iterencode_list needs a sequence");
if (s_fast == NULL)
return -1;
num_items = PySequence_Fast_GET_SIZE(s_fast);
if (num_items == 0) {
if (PySequence_Fast_GET_SIZE(s_fast) == 0) {
Py_DECREF(s_fast);
return _PyAccu_Accumulate(acc, empty_array);
}
@ -1696,7 +1693,6 @@ encoder_listencode_list(PyEncoderObject *s, _PyAccu *acc,
}
}
seq_items = PySequence_Fast_ITEMS(s_fast);
if (_PyAccu_Accumulate(acc, open_array))
goto bail;
if (s->indent != Py_None) {
@ -1708,8 +1704,8 @@ encoder_listencode_list(PyEncoderObject *s, _PyAccu *acc,
buf += newline_indent
*/
}
for (i = 0; i < num_items; i++) {
PyObject *obj = seq_items[i];
for (i = 0; i < PySequence_Fast_GET_SIZE(s_fast); i++) {
PyObject *obj = PySequence_Fast_GET_ITEM(s_fast, i);
if (i) {
if (_PyAccu_Accumulate(acc, s->item_separator))
goto bail;