mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-09-12 19:57:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

bpo-44184: Apply GH-26274 to the non-GC-type branch of subtype_dealloc (GH-27165) (GH-27174)

Browse source 
The non-GC-type branch of subtype_dealloc is using the type of an object after freeing in the same unsafe way as GH-26274 fixes. (I believe the old news entry covers this change well enough.)

https://bugs.python.org/issue44184
(cherry picked from commit 074e7659f2)

Co-authored-by: T. Wouters <thomas@python.org>
This commit is contained in:
Miss Islington (bot) 2021-07-15 16:18:16 -07:00 • committed by GitHub
parent 356bdff1e9
commit 6aa59c68dc
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

14
Objects/typeobject.c
View file

@ -1344,14 +1344,22 @@ subtype_dealloc(PyObject *self)
/* Extract the type again; tp_del may have changed it */ /* Extract the type again; tp_del may have changed it */
type = Py_TYPE(self); type = Py_TYPE(self);
// Don't read type memory after calling basedealloc() since basedealloc()
// can deallocate the type and free its memory.
int type_needs_decref = (type->tp_flags & Py_TPFLAGS_HEAPTYPE
&& !(base->tp_flags & Py_TPFLAGS_HEAPTYPE));
/* Call the base tp_dealloc() */ /* Call the base tp_dealloc() */
assert(basedealloc); assert(basedealloc);
basedealloc(self); basedealloc(self);
/* Only decref if the base type is not already a heap allocated type. /* Can't reference self beyond this point. It's possible tp_del switched
Otherwise, basedealloc should have decref'd it already */ our type from a HEAPTYPE to a non-HEAPTYPE, so be careful about
if (type->tp_flags & Py_TPFLAGS_HEAPTYPE && !(base->tp_flags & Py_TPFLAGS_HEAPTYPE)) reference counting. Only decref if the base type is not already a heap
allocated type. Otherwise, basedealloc should have decref'd it already */
if (type_needs_decref) {
Py_DECREF(type); Py_DECREF(type);
}
/* Done */ /* Done */
return; return;