mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-04 00:48:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

Issue #18328: Reorder ops in PyThreadState_Delete*() functions. Now the

Browse source 
tstate is first removed from TLS and then deallocated.
CID 1019639 (#1 of 1): Use after free (USE_AFTER_FREE)
 use_after_free: Using freed pointer tstate.
This commit is contained in:
Christian Heimes 2013-07-01 23:42:28 +02:00
parent 2178248858
commit b9dbc7d6e1
2 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Python/pystate.c
View file

@ -388,11 +388,11 @@ PyThreadState_Delete(PyThreadState *tstate)
{
if (tstate == _Py_atomic_load_relaxed(&_PyThreadState_Current))
Py_FatalError("PyThreadState_Delete: tstate is still current");
tstate_delete_common(tstate);
#ifdef WITH_THREAD
if (autoInterpreterState && PyThread_get_key_value(autoTLSkey) == tstate)
PyThread_delete_key_value(autoTLSkey);
#endif /* WITH_THREAD */
tstate_delete_common(tstate);
}
@ -406,9 +406,9 @@ PyThreadState_DeleteCurrent()
Py_FatalError(
"PyThreadState_DeleteCurrent: no current tstate");
_Py_atomic_store_relaxed(&_PyThreadState_Current, NULL);
tstate_delete_common(tstate);
if (autoInterpreterState && PyThread_get_key_value(autoTLSkey) == tstate)
PyThread_delete_key_value(autoTLSkey);
tstate_delete_common(tstate);
PyEval_ReleaseLock();
}
#endif /* WITH_THREAD */