diff options
| author | Yannick Jadoul <yannick.jadoul@belgacom.net> | 2020-10-12 23:06:19 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-10-13 00:06:19 +0300 |
| commit | 04b8631d84a870dda456ef86039c1baf34d08500 (patch) | |
| tree | a452d703f712dcf9baae2c67b5439886da6adf40 | |
| parent | 24a54c0bd48d9f6f1a1289ca57afb381bc4b280e (diff) | |
| download | cpython3-04b8631d84a870dda456ef86039c1baf34d08500.tar.gz | |
bpo-42015: Reorder dereferencing calls in meth_dealloc, to make sure m_self is kept alive long enough (GH-22670)
| -rw-r--r-- | Misc/NEWS.d/next/C API/2020-10-12-20-13-58.bpo-42015.X4H2_V.rst | 3 | ||||
| -rw-r--r-- | Objects/methodobject.c | 6 |
2 files changed, 7 insertions, 2 deletions
diff --git a/Misc/NEWS.d/next/C API/2020-10-12-20-13-58.bpo-42015.X4H2_V.rst b/Misc/NEWS.d/next/C API/2020-10-12-20-13-58.bpo-42015.X4H2_V.rst new file mode 100644 index 0000000000..d77619f64b --- /dev/null +++ b/Misc/NEWS.d/next/C API/2020-10-12-20-13-58.bpo-42015.X4H2_V.rst @@ -0,0 +1,3 @@ +Fix potential crash in deallocating method objects when dynamically +allocated `PyMethodDef`'s lifetime is managed through the ``self`` +argument of a `PyCFunction`. diff --git a/Objects/methodobject.c b/Objects/methodobject.c index 5659f2143d..7b430416c5 100644 --- a/Objects/methodobject.c +++ b/Objects/methodobject.c @@ -164,9 +164,11 @@ meth_dealloc(PyCFunctionObject *m) if (m->m_weakreflist != NULL) { PyObject_ClearWeakRefs((PyObject*) m); } + // Dereference class before m_self: PyCFunction_GET_CLASS accesses + // PyMethodDef m_ml, which could be kept alive by m_self + Py_XDECREF(PyCFunction_GET_CLASS(m)); Py_XDECREF(m->m_self); Py_XDECREF(m->m_module); - Py_XDECREF(PyCFunction_GET_CLASS(m)); PyObject_GC_Del(m); } @@ -243,9 +245,9 @@ meth_get__qualname__(PyCFunctionObject *m, void *closure) static int meth_traverse(PyCFunctionObject *m, visitproc visit, void *arg) { + Py_VISIT(PyCFunction_GET_CLASS(m)); Py_VISIT(m->m_self); Py_VISIT(m->m_module); - Py_VISIT(PyCFunction_GET_CLASS(m)); return 0; } |