mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-11-02 11:08:57 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 15

bpo-27946: Fix possible crash in ElementTree.Element (GH-29915)

Browse source 
Getting an attribute via attrib.get() simultaneously with replacing
the attrib dict can lead to access to deallocated dict.
This commit is contained in:
Serhiy Storchaka 2021-12-05 14:22:54 +02:00 • committed by GitHub
parent f42a06ba27
commit d15cdb2f32
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 25 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

23
Modules/_elementtree.c
View file

@ -1393,22 +1393,19 @@ _elementtree_Element_get_impl(ElementObject *self, PyObject *key,
PyObject *default_value)
/*[clinic end generated code: output=523c614142595d75 input=ee153bbf8cdb246e]*/
{
PyObject* value;
if (!self->extra || !self->extra->attrib)
value = default_value;
else {
value = PyDict_GetItemWithError(self->extra->attrib, key);
if (!value) {
if (PyErr_Occurred()) {
return NULL;
}
value = default_value;
if (self->extra && self->extra->attrib) {
PyObject *attrib = self->extra->attrib;
Py_INCREF(attrib);
PyObject *value = PyDict_GetItemWithError(attrib, key);
Py_XINCREF(value);
Py_DECREF(attrib);
if (value != NULL || PyErr_Occurred()) {
return value;
}
}
Py_INCREF(value);
return value;
Py_INCREF(default_value);
return default_value;
}
static PyObject *