Wrote down the invariants of some common objects whose structure is

exposed in header files.  Fixed a few comments in these headers.

As we might have expected, writing down invariants systematically exposed a
(minor) bug.  In this case, function objects have a writeable func_code
attribute, which could be set to code objects with the wrong number of
free variables.  Calling the resulting function segfaulted the interpreter.
Added a corresponding test.
This commit is contained in:
Armin Rigo 2004-10-28 16:32:00 +00:00
parent 063e1e846d
commit 89a39461bf
12 changed files with 98 additions and 25 deletions

View file

@ -230,6 +230,7 @@ static int
func_set_code(PyFunctionObject *op, PyObject *value)
{
PyObject *tmp;
int nfree, nclosure;
if (restricted())
return -1;
@ -240,6 +241,17 @@ func_set_code(PyFunctionObject *op, PyObject *value)
"func_code must be set to a code object");
return -1;
}
nfree = PyCode_GetNumFree((PyCodeObject *)value);
nclosure = (op->func_closure == NULL ? 0 :
PyTuple_GET_SIZE(op->func_closure));
if (nclosure != nfree) {
PyErr_Format(PyExc_ValueError,
"%s() requires a code object with %d free vars,"
" not %d",
PyString_AsString(op->func_name),
nclosure, nfree);
return -1;
}
tmp = op->func_code;
Py_INCREF(value);
op->func_code = value;