mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-04 08:59:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

gh-118331: Fix a couple of issues when list allocation fails (#130811)

Browse source 
* Fix use after free in list objects

Set the items pointer in the list object to NULL after the items array
is freed during list deallocation. Otherwise, we can end up with a list
object added to the free list that contains a pointer to an already-freed
items array.

* Mark `_PyList_FromStackRefStealOnSuccess` as escaping

I think technically it's not escaping, because the only object that
can be decrefed if allocation fails is an exact list, which cannot
execute arbitrary code when it is destroyed. However, this seems less
intrusive than trying to special cases objects in the assert in `_Py_Dealloc`
that checks for non-null stackpointers and shouldn't matter for performance.
This commit is contained in:
mpage 2025-03-05 10:42:09 -08:00 • committed by GitHub
parent 2904ec2273
commit d7bb7c7817
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
7 changed files with 26 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

1
Tools/cases_generator/analyzer.py
View file

@ -632,7 +632,6 @@ NON_ESCAPING_FUNCTIONS = (
"_PyGen_GetGeneratorFromFrame",
"_PyInterpreterState_GET",
"_PyList_AppendTakeRef",
"_PyList_FromStackRefStealOnSuccess",
"_PyList_ITEMS",
"_PyLong_CompactValue",
"_PyLong_DigitCount",