mirror of
https://github.com/python/cpython.git
synced 2025-08-04 17:08:35 +00:00
[3.11] gh-99240: Fix double-free bug in Argument Clinic str_converter generated code (GH-99241) (#100352)
(cherry picked from commit 8dbe08eb7c
)
Fix double-free bug mentioned at GH-99240, by moving memory clean up out of "exit" label.
This commit is contained in:
parent
cfa78ecc12
commit
ba8e30c56b
6 changed files with 201 additions and 25 deletions
|
@ -551,6 +551,64 @@ error:
|
|||
}
|
||||
|
||||
|
||||
/*[clinic input]
|
||||
str_converter_encoding
|
||||
|
||||
a: str(encoding="idna")
|
||||
b: str(encoding="idna", accept={bytes, bytearray, str})
|
||||
c: str(encoding="idna", accept={bytes, bytearray, str}, zeroes=True)
|
||||
/
|
||||
|
||||
[clinic start generated code]*/
|
||||
|
||||
static PyObject *
|
||||
str_converter_encoding_impl(PyObject *module, char *a, char *b, char *c,
|
||||
Py_ssize_t c_length)
|
||||
/*[clinic end generated code: output=af68766049248a1c input=0c5cf5159d0e870d]*/
|
||||
{
|
||||
assert(!PyErr_Occurred());
|
||||
PyObject *out[3] = {NULL,};
|
||||
int i = 0;
|
||||
PyObject *arg;
|
||||
|
||||
arg = PyUnicode_FromString(a);
|
||||
assert(arg || PyErr_Occurred());
|
||||
if (!arg) {
|
||||
goto error;
|
||||
}
|
||||
out[i++] = arg;
|
||||
|
||||
arg = PyUnicode_FromString(b);
|
||||
assert(arg || PyErr_Occurred());
|
||||
if (!arg) {
|
||||
goto error;
|
||||
}
|
||||
out[i++] = arg;
|
||||
|
||||
arg = PyUnicode_FromStringAndSize(c, c_length);
|
||||
assert(arg || PyErr_Occurred());
|
||||
if (!arg) {
|
||||
goto error;
|
||||
}
|
||||
out[i++] = arg;
|
||||
|
||||
PyObject *tuple = PyTuple_New(3);
|
||||
if (!tuple) {
|
||||
goto error;
|
||||
}
|
||||
for (int j = 0; j < 3; j++) {
|
||||
PyTuple_SET_ITEM(tuple, j, out[j]);
|
||||
}
|
||||
return tuple;
|
||||
|
||||
error:
|
||||
for (int j = 0; j < i; j++) {
|
||||
Py_DECREF(out[j]);
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
|
||||
|
||||
static PyObject *
|
||||
bytes_from_buffer(Py_buffer *buf)
|
||||
{
|
||||
|
@ -927,6 +985,25 @@ gh_99233_refcount_impl(PyObject *module, PyObject *args)
|
|||
}
|
||||
|
||||
|
||||
/*[clinic input]
|
||||
gh_99240_double_free
|
||||
|
||||
a: str(encoding="idna")
|
||||
b: str(encoding="idna")
|
||||
/
|
||||
|
||||
Proof-of-concept of GH-99240 double-free bug.
|
||||
|
||||
[clinic start generated code]*/
|
||||
|
||||
static PyObject *
|
||||
gh_99240_double_free_impl(PyObject *module, char *a, char *b)
|
||||
/*[clinic end generated code: output=586dc714992fe2ed input=23db44aa91870fc7]*/
|
||||
{
|
||||
Py_RETURN_NONE;
|
||||
}
|
||||
|
||||
|
||||
static PyMethodDef tester_methods[] = {
|
||||
TEST_EMPTY_FUNCTION_METHODDEF
|
||||
OBJECTS_CONVERTER_METHODDEF
|
||||
|
@ -951,6 +1028,7 @@ static PyMethodDef tester_methods[] = {
|
|||
DOUBLE_CONVERTER_METHODDEF
|
||||
PY_COMPLEX_CONVERTER_METHODDEF
|
||||
STR_CONVERTER_METHODDEF
|
||||
STR_CONVERTER_ENCODING_METHODDEF
|
||||
PY_BUFFER_CONVERTER_METHODDEF
|
||||
KEYWORDS_METHODDEF
|
||||
KEYWORDS_KWONLY_METHODDEF
|
||||
|
@ -970,6 +1048,7 @@ static PyMethodDef tester_methods[] = {
|
|||
KEYWORD_ONLY_PARAMETER_METHODDEF
|
||||
VARARG_AND_POSONLY_METHODDEF
|
||||
GH_99233_REFCOUNT_METHODDEF
|
||||
GH_99240_DOUBLE_FREE_METHODDEF
|
||||
{NULL, NULL}
|
||||
};
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue