mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-04 00:48:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

GH-97592: Fix crash in C remove_done_callback due to evil code (#97660)

Browse source 
Evil code could cause fut_callbacks to be cleared when PyObject_RichCompareBool is called.
This commit is contained in:
Guido van Rossum 2022-09-30 12:57:09 -07:00 • committed by GitHub
parent e9d63760fe
commit 63780f4599
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 23 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
Modules/_asynciomodule.c
View file

@ -1052,7 +1052,11 @@ _asyncio_Future_remove_done_callback(FutureObj *self, PyObject *fn)
return NULL;
}
for (i = 0; i < PyList_GET_SIZE(self->fut_callbacks); i++) {
// Beware: PyObject_RichCompareBool below may change fut_callbacks.
// See GH-97592.
for (i = 0;
self->fut_callbacks != NULL && i < PyList_GET_SIZE(self->fut_callbacks);
i++) {
int ret;
PyObject *item = PyList_GET_ITEM(self->fut_callbacks, i);
Py_INCREF(item);
@ -1071,7 +1075,8 @@ _asyncio_Future_remove_done_callback(FutureObj *self, PyObject *fn)
}
}
if (j == 0) {
// Note: fut_callbacks may have been cleared.
if (j == 0 || self->fut_callbacks == NULL) {
Py_CLEAR(self->fut_callbacks);
Py_DECREF(newlist);
return PyLong_FromSsize_t(len + cleared_callback0);