Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
C
cpython
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
0
Merge Requests
0
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
Kirill Smelkov
cpython
Commits
2294f3ae
Commit
2294f3ae
authored
8 years ago
by
INADA Naoki
Committed by
GitHub
8 years ago
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
bpo-29438: fixed use-after-free in key sharing dict (#17)
parent
e7ffb99f
Changes
2
Show whitespace changes
Inline
Side-by-side
Showing
2 changed files
with
9 additions
and
3 deletions
+9
-3
Misc/NEWS
Misc/NEWS
+2
-0
Objects/dictobject.c
Objects/dictobject.c
+7
-3
No files found.
Misc/NEWS
View file @
2294f3ae
...
@@ -10,6 +10,8 @@ What's New in Python 3.7.0 alpha 1?
...
@@ -10,6 +10,8 @@ What's New in Python 3.7.0 alpha 1?
Core and Builtins
Core and Builtins
-----------------
-----------------
- bpo-29438: Fixed use-after-free problem in key sharing dict.
- Issue #29319: Prevent RunMainFromImporter overwriting sys.path[0].
- Issue #29319: Prevent RunMainFromImporter overwriting sys.path[0].
- Issue #29337: Fixed possible BytesWarning when compare the code objects.
- Issue #29337: Fixed possible BytesWarning when compare the code objects.
...
...
This diff is collapsed.
Click to expand it.
Objects/dictobject.c
View file @
2294f3ae
...
@@ -4352,15 +4352,19 @@ _PyObjectDict_SetItem(PyTypeObject *tp, PyObject **dictptr,
...
@@ -4352,15 +4352,19 @@ _PyObjectDict_SetItem(PyTypeObject *tp, PyObject **dictptr,
}
}
if
(
value
==
NULL
)
{
if
(
value
==
NULL
)
{
res
=
PyDict_DelItem
(
dict
,
key
);
res
=
PyDict_DelItem
(
dict
,
key
);
if
(
cached
!=
((
PyDictObject
*
)
dict
)
->
ma_keys
)
{
// Since key sharing dict doesn't allow deletion, PyDict_DelItem()
// always converts dict to combined form.
if
((
cached
=
CACHED_KEYS
(
tp
))
!=
NULL
)
{
CACHED_KEYS
(
tp
)
=
NULL
;
CACHED_KEYS
(
tp
)
=
NULL
;
DK_DECREF
(
cached
);
DK_DECREF
(
cached
);
}
}
}
}
else
{
else
{
int
was_shared
=
cached
==
((
PyDictObject
*
)
dict
)
->
ma_keys
;
int
was_shared
=
(
cached
==
((
PyDictObject
*
)
dict
)
->
ma_keys
)
;
res
=
PyDict_SetItem
(
dict
,
key
,
value
);
res
=
PyDict_SetItem
(
dict
,
key
,
value
);
if
(
was_shared
&&
cached
!=
((
PyDictObject
*
)
dict
)
->
ma_keys
)
{
if
(
was_shared
&&
(
cached
=
CACHED_KEYS
(
tp
))
!=
NULL
&&
cached
!=
((
PyDictObject
*
)
dict
)
->
ma_keys
)
{
/* PyDict_SetItem() may call dictresize and convert split table
/* PyDict_SetItem() may call dictresize and convert split table
* into combined table. In such case, convert it to split
* into combined table. In such case, convert it to split
* table again and update type's shared key only when this is
* table again and update type's shared key only when this is
...
...
This diff is collapsed.
Click to expand it.
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment