mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-09-30 12:21:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

bpo-29438: fixed use-after-free in key sharing dict (#39)

Browse source
This commit is contained in:
INADA Naoki 2017-02-13 09:19:05 +09:00 • committed by GitHub
parent f66c81ff49
commit 89ddffbe9d
2 changed files with 9 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Misc/NEWS
View file

@ -10,6 +10,8 @@ What's New in Python 3.6.1 release candidate 1?
Core and Builtins Core and Builtins
----------------- -----------------
- bpo-29438: Fixed use-after-free problem in key sharing dict.
- Issue #29319: Prevent RunMainFromImporter overwriting sys.path[0]. - Issue #29319: Prevent RunMainFromImporter overwriting sys.path[0].
- Issue #29337: Fixed possible BytesWarning when compare the code objects. - Issue #29337: Fixed possible BytesWarning when compare the code objects.

10
Objects/dictobject.c
View file

@ -4376,15 +4376,19 @@ _PyObjectDict_SetItem(PyTypeObject *tp, PyObject **dictptr,
} }
if (value == NULL) { if (value == NULL) {
res = PyDict_DelItem(dict, key); res = PyDict_DelItem(dict, key);
if (cached != ((PyDictObject *)dict)->ma_keys) { // Since key sharing dict doesn't allow deletion, PyDict_DelItem()
// always converts dict to combined form.
if ((cached = CACHED_KEYS(tp)) != NULL) {
CACHED_KEYS(tp) = NULL; CACHED_KEYS(tp) = NULL;
DK_DECREF(cached); DK_DECREF(cached);
} }
} }
else { else {
int was_shared = cached == ((PyDictObject *)dict)->ma_keys; int was_shared = (cached == ((PyDictObject *)dict)->ma_keys);
res = PyDict_SetItem(dict, key, value); res = PyDict_SetItem(dict, key, value);
if (was_shared && cached != ((PyDictObject *)dict)->ma_keys) { if (was_shared &&
(cached = CACHED_KEYS(tp)) != NULL &&
cached != ((PyDictObject *)dict)->ma_keys) {
/* PyDict_SetItem() may call dictresize and convert split table /* PyDict_SetItem() may call dictresize and convert split table
* into combined table. In such case, convert it to split * into combined table. In such case, convert it to split
* table again and update type's shared key only when this is * table again and update type's shared key only when this is