Sorry, I sent the fixed version.
These two incref's are missing!
On 10.12.19 14:16, Christian Tismer wrote:
> Hi Łukasz,
>
> tonite I found a critical bug that affects all heaptype extension
> classes with a custom (not PyType_Type) type.
>
> the bug is in typeobject.c function type_mro_modified line 309:
>
> if (custom) {
> _Py_IDENTIFIER(mro);
> mro_meth = lookup_maybe_method(
> (PyObject *)type, &PyId_mro, &unbound);
> if (mro_meth == NULL)
> goto clear;This one > Py_INCREF(mro_meth); > type_mro_meth = lookup_maybe_method( > (PyObject *)&PyType_Type, &PyId_mro, &unbound); > if (type_mro_meth == NULL) > goto clear; And this one > Py_INCREF(type_mro_meth); > if (mro_meth != type_mro_meth) > goto clear; > Py_XDECREF(mro_meth); > Py_XDECREF(type_mro_meth); > } > > This block is wrong because it decrefs a value that comes from > lookup_maybe_method which does not incref. > > The code is easily fixed by two Py_INCREF s. > > Please let me know how you want to proceed. > This is a critical error, producing negative refcounts. > > Cheers -- Chris -- Christian Tismer :^) tis...@stackless.com Software Consulting : http://www.stackless.com/ Karl-Liebknecht-Str. 121 : https://github.com/PySide 14482 Potsdam : GPG key -> 0xFB7BEE0E phone +49 173 24 18 776 fax +49 (30) 700143-0023
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Python-Dev mailing list -- python-dev@python.org To unsubscribe send an email to python-dev-le...@python.org https://mail.python.org/mailman3/lists/python-dev.python.org/ Message archived at https://mail.python.org/archives/list/python-dev@python.org/message/K2SX7F7P5CXJ7PMK2AAIU7JTAG2AH2A5/ Code of Conduct: http://python.org/psf/codeofconduct/
