mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-09-26 10:19:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

Issue #18328: Reorder ops in PyThreadState_Delete*() functions. Now the

Browse source 
tstate is first removed from TLS and then deallocated.
CID 1019639 (#1 of 1): Use after free (USE_AFTER_FREE)
 use_after_free: Using freed pointer tstate.
This commit is contained in:
Christian Heimes 2013-07-01 23:42:28 +02:00
parent 2178248858
commit b9dbc7d6e1
2 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Misc/NEWS
View file

@ -12,6 +12,9 @@ What's New in Python 3.3.3 release candidate 1?
Core and Builtins Core and Builtins
----------------- -----------------
- Issue #18328: Reorder ops in PyThreadState_Delete*() functions. Now the
tstate is first removed from TLS and then deallocated.
- Issue #18184: PyUnicode_FromFormat() and PyUnicode_FromFormatV() now raise - Issue #18184: PyUnicode_FromFormat() and PyUnicode_FromFormatV() now raise
OverflowError when an argument of %c format is out of range. OverflowError when an argument of %c format is out of range.

4
Python/pystate.c
View file

@ -388,11 +388,11 @@ PyThreadState_Delete(PyThreadState *tstate)
{ {
if (tstate == _Py_atomic_load_relaxed(&_PyThreadState_Current)) if (tstate == _Py_atomic_load_relaxed(&_PyThreadState_Current))
Py_FatalError("PyThreadState_Delete: tstate is still current"); Py_FatalError("PyThreadState_Delete: tstate is still current");
tstate_delete_common(tstate);
#ifdef WITH_THREAD #ifdef WITH_THREAD
if (autoInterpreterState && PyThread_get_key_value(autoTLSkey) == tstate) if (autoInterpreterState && PyThread_get_key_value(autoTLSkey) == tstate)
PyThread_delete_key_value(autoTLSkey); PyThread_delete_key_value(autoTLSkey);
#endif /* WITH_THREAD */ #endif /* WITH_THREAD */
tstate_delete_common(tstate);
} }
@ -406,9 +406,9 @@ PyThreadState_DeleteCurrent()
Py_FatalError( Py_FatalError(
"PyThreadState_DeleteCurrent: no current tstate"); "PyThreadState_DeleteCurrent: no current tstate");
_Py_atomic_store_relaxed(&_PyThreadState_Current, NULL); _Py_atomic_store_relaxed(&_PyThreadState_Current, NULL);
tstate_delete_common(tstate);
if (autoInterpreterState && PyThread_get_key_value(autoTLSkey) == tstate) if (autoInterpreterState && PyThread_get_key_value(autoTLSkey) == tstate)
PyThread_delete_key_value(autoTLSkey); PyThread_delete_key_value(autoTLSkey);
tstate_delete_common(tstate);
PyEval_ReleaseLock(); PyEval_ReleaseLock();
} }
#endif /* WITH_THREAD */ #endif /* WITH_THREAD */