Commit a49de6be authored by Serhiy Storchaka's avatar Serhiy Storchaka

Issue #25725: Fixed a reference leak in pickle.loads() when unpickling

invalid data including tuple instructions.
parent 4f44d537
......@@ -106,6 +106,9 @@ Core and Builtins
Library
-------
- Issue #25725: Fixed a reference leak in pickle.loads() when unpickling
invalid data including tuple instructions.
- Issue #25663: In the Readline completer, avoid listing duplicate global
names, and search the global namespace before searching builtins.
......
......@@ -4915,15 +4915,14 @@ load_counted_binunicode(UnpicklerObject *self, int nbytes)
}
static int
load_tuple(UnpicklerObject *self)
load_counted_tuple(UnpicklerObject *self, int len)
{
PyObject *tuple;
Py_ssize_t i;
if ((i = marker(self)) < 0)
return -1;
if (Py_SIZE(self->stack) < len)
return stack_underflow();
tuple = Pdata_poptuple(self->stack, i);
tuple = Pdata_poptuple(self->stack, Py_SIZE(self->stack) - len);
if (tuple == NULL)
return -1;
PDATA_PUSH(self->stack, tuple, -1);
......@@ -4931,24 +4930,14 @@ load_tuple(UnpicklerObject *self)
}
static int
load_counted_tuple(UnpicklerObject *self, int len)
load_tuple(UnpicklerObject *self)
{
PyObject *tuple;
Py_ssize_t i;
tuple = PyTuple_New(len);
if (tuple == NULL)
if ((i = marker(self)) < 0)
return -1;
while (--len >= 0) {
PyObject *item;
PDATA_POP(self->stack, item);
if (item == NULL)
return -1;
PyTuple_SET_ITEM(tuple, len, item);
}
PDATA_PUSH(self->stack, tuple, -1);
return 0;
return load_counted_tuple(self, Py_SIZE(self->stack) - i);
}
static int
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment