mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-04 00:48:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

[3.9] gh-92112: Fix crash triggered by an evil custom mro() (GH-92113) (GH-92372)

Browse source 
(cherry picked from commit 85354ed78c)

Co-authored-by: Alexey Izbyshev <izbyshev@ispras.ru>
This commit is contained in:
Jelle Zijlstra 2022-05-16 09:47:35 -07:00 • committed by GitHub
parent 518b238967
commit f82b32410b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 29 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

20
Objects/typeobject.c
View file

@ -317,25 +317,29 @@ type_mro_modified(PyTypeObject *type, PyObject *bases) {
Py_ssize_t i, n;
int custom = !Py_IS_TYPE(type, &PyType_Type);
int unbound;
PyObject *mro_meth = NULL;
PyObject *type_mro_meth = NULL;
if (!_PyType_HasFeature(type, Py_TPFLAGS_HAVE_VERSION_TAG))
return;
if (custom) {
PyObject *mro_meth, *type_mro_meth;
mro_meth = lookup_maybe_method(
(PyObject *)type, &PyId_mro, &unbound);
if (mro_meth == NULL)
if (mro_meth == NULL) {
goto clear;
}
type_mro_meth = lookup_maybe_method(
(PyObject *)&PyType_Type, &PyId_mro, &unbound);
if (type_mro_meth == NULL)
if (type_mro_meth == NULL) {
Py_DECREF(mro_meth);
goto clear;
if (mro_meth != type_mro_meth)
}
int custom_mro = (mro_meth != type_mro_meth);
Py_DECREF(mro_meth);
Py_DECREF(type_mro_meth);
if (custom_mro) {
goto clear;
Py_XDECREF(mro_meth);
Py_XDECREF(type_mro_meth);
}
}
n = PyTuple_GET_SIZE(bases);
for (i = 0; i < n; i++) {
@ -352,8 +356,6 @@ type_mro_modified(PyTypeObject *type, PyObject *bases) {
}
return;
clear:
Py_XDECREF(mro_meth);
Py_XDECREF(type_mro_meth);
type->tp_flags &= ~(Py_TPFLAGS_HAVE_VERSION_TAG|
Py_TPFLAGS_VALID_VERSION_TAG);
}