mirror of
https://github.com/python/cpython.git
synced 2025-08-01 15:43:13 +00:00
Wrote down the invariants of some common objects whose structure is
exposed in header files. Fixed a few comments in these headers. As we might have expected, writing down invariants systematically exposed a (minor) bug. In this case, function objects have a writeable func_code attribute, which could be set to code objects with the wrong number of free variables. Calling the resulting function segfaulted the interpreter. Added a corresponding test.
This commit is contained in:
parent
063e1e846d
commit
89a39461bf
12 changed files with 98 additions and 25 deletions
|
@ -230,6 +230,7 @@ static int
|
|||
func_set_code(PyFunctionObject *op, PyObject *value)
|
||||
{
|
||||
PyObject *tmp;
|
||||
int nfree, nclosure;
|
||||
|
||||
if (restricted())
|
||||
return -1;
|
||||
|
@ -240,6 +241,17 @@ func_set_code(PyFunctionObject *op, PyObject *value)
|
|||
"func_code must be set to a code object");
|
||||
return -1;
|
||||
}
|
||||
nfree = PyCode_GetNumFree((PyCodeObject *)value);
|
||||
nclosure = (op->func_closure == NULL ? 0 :
|
||||
PyTuple_GET_SIZE(op->func_closure));
|
||||
if (nclosure != nfree) {
|
||||
PyErr_Format(PyExc_ValueError,
|
||||
"%s() requires a code object with %d free vars,"
|
||||
" not %d",
|
||||
PyString_AsString(op->func_name),
|
||||
nclosure, nfree);
|
||||
return -1;
|
||||
}
|
||||
tmp = op->func_code;
|
||||
Py_INCREF(value);
|
||||
op->func_code = value;
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue