https://github.com/python/cpython/commit/671360161f0b7a5ff4c1d062e570962e851b4bde
commit: 671360161f0b7a5ff4c1d062e570962e851b4bde
branch: main
author: kcatss <[email protected]>
committer: serhiy-storchaka <[email protected]>
date: 2024-02-14T16:08:26Z
summary:
gh-115243: Fix crash in deque.index() when the deque is concurrently modified
(GH-115247)
files:
A Misc/NEWS.d/next/Security/2024-02-12-00-33-01.gh-issue-115243.e1oGX8.rst
M Lib/test/test_deque.py
M Modules/_collectionsmodule.c
diff --git a/Lib/test/test_deque.py b/Lib/test/test_deque.py
index ae1dfacd7262e4..4679f297fd7f4a 100644
--- a/Lib/test/test_deque.py
+++ b/Lib/test/test_deque.py
@@ -166,7 +166,7 @@ def test_contains(self):
with self.assertRaises(RuntimeError):
n in d
- def test_contains_count_stop_crashes(self):
+ def test_contains_count_index_stop_crashes(self):
class A:
def __eq__(self, other):
d.clear()
@@ -178,6 +178,10 @@ def __eq__(self, other):
with self.assertRaises(RuntimeError):
_ = d.count(3)
+ d = deque([A()])
+ with self.assertRaises(RuntimeError):
+ d.index(0)
+
def test_extend(self):
d = deque('a')
self.assertRaises(TypeError, d.extend, 1)
diff --git
a/Misc/NEWS.d/next/Security/2024-02-12-00-33-01.gh-issue-115243.e1oGX8.rst
b/Misc/NEWS.d/next/Security/2024-02-12-00-33-01.gh-issue-115243.e1oGX8.rst
new file mode 100644
index 00000000000000..ae0e910c7d159c
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2024-02-12-00-33-01.gh-issue-115243.e1oGX8.rst
@@ -0,0 +1 @@
+Fix possible crashes in :meth:`collections.deque.index` when the deque is
concurrently modified.
diff --git a/Modules/_collectionsmodule.c b/Modules/_collectionsmodule.c
index ef77d34b10e47b..4fa76d62bc3f8d 100644
--- a/Modules/_collectionsmodule.c
+++ b/Modules/_collectionsmodule.c
@@ -1218,8 +1218,9 @@ deque_index_impl(dequeobject *deque, PyObject *v,
Py_ssize_t start,
n = stop - i;
while (--n >= 0) {
CHECK_NOT_END(b);
- item = b->data[index];
+ item = Py_NewRef(b->data[index]);
cmp = PyObject_RichCompareBool(item, v, Py_EQ);
+ Py_DECREF(item);
if (cmp > 0)
return PyLong_FromSsize_t(stop - n - 1);
if (cmp < 0)
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3/lists/python-checkins.python.org/
Member address: [email protected]
