[issue16445] SEGFAULT when deleting Exception.message
Antoine Pitrou added the comment: This looks like it is fixed by Mark's commit. Other proposals should go into separate issues. -- nosy: +pitrou resolution: - fixed stage: needs patch - committed/rejected status: open - closed versions: -Python 3.2, Python 3.3, Python 3.4 ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16445 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16445] SEGFAULT when deleting Exception.message
Mark Lawrence added the comment: It looks as if this issue can be closed as a fix has been committed. However a new issue will be needed if the advice offered in msg181839 is followed. -- nosy: +BreamoreBoy ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16445 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16445] SEGFAULT when deleting Exception.message
Roundup Robot added the comment: New changeset 0e41c4466d58 by Mark Dickinson in branch '2.7': Issue #16445: Fix potential segmentation fault when deleting an exception message. http://hg.python.org/cpython/rev/0e41c4466d58 -- nosy: +python-dev ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16445 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16445] SEGFAULT when deleting Exception.message
Mark Dickinson added the comment: Can I suggest fixing this particular issue with a dedicated patch, and opening another issue to consider the large automated replacements that Victor's proposing? -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16445 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16445] SEGFAULT when deleting Exception.message
Mark Dickinson added the comment: Here's a simple patch (against 2.7) for this particular issue. -- Added file: http://bugs.python.org/file29035/issue16445.patch ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16445 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16445] SEGFAULT when deleting Exception.message
Serhiy Storchaka added the comment: Here's a simple patch (against 2.7) for this particular issue. LGTM. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16445 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16445] SEGFAULT when deleting Exception.message
Changes by Serhiy Storchaka storch...@gmail.com: -- priority: normal - high ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16445 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16445] SEGFAULT when deleting Exception.message
Changes by Mark Dickinson dicki...@gmail.com: -- nosy: +mark.dickinson ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16445 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16445] SEGFAULT when deleting Exception.message
Changes by John O'Connor tehj...@gmail.com: -- nosy: +jcon ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16445 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16445] SEGFAULT when deleting Exception.message
Serhiy Storchaka added the comment: Victor, I will be glad to review any related patches, but please split the patch on several patches, from most undoubted to more sophisticated patterns. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16445 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16445] SEGFAULT when deleting Exception.message
Serhiy Storchaka added the comment: The Coccinelle looks as an amazing tool! I propose split a patch on several patches (autogenerated code, attributes clearing, other pointer expressions (as *exceptionObject or unicode_latin1[i]) clearing, and local pointers clearing at the end) and commit they separately. -- components: +Extension Modules, Interpreter Core nosy: +serhiy.storchaka stage: - needs patch versions: +Python 2.7, Python 3.2, Python 3.3, Python 3.4 ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16445 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16445] SEGFAULT when deleting Exception.message
Changes by Jesús Cea Avión j...@jcea.es: -- nosy: +jcea ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16445 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16445] SEGFAULT when deleting Exception.message
New submission from Amaury Forgeot d'Arc: The script below segfaults cpython2.7. The cause is in BaseException_set_message(), which calls Py_XDECREF(self-message) and thus can call back into Python code with a dangling PyObject* pointer. Py_CLEAR should be used instead. class Nasty(str): def __del__(self): del e.message e = ValueError(Nasty(msg)) e.args = () del e.message del e -- messages: 175203 nosy: amaury.forgeotdarc priority: normal severity: normal status: open title: SEGFAULT when deleting Exception.message type: crash ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16445 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16445] SEGFAULT when deleting Exception.message
Changes by STINNER Victor victor.stin...@gmail.com: -- nosy: +haypo ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16445 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16445] SEGFAULT when deleting Exception.message
STINNER Victor added the comment: According to Amaury an IRC, replacing Py_XDECREF(obj-attr); obj-attr = NULL; pattern with Py_CLEAR(obj-attr); should fix the issue. Instead of opening one issue per occurence of this pattern, it is possible to write a semantic patch to do the replace on the whole CPython project using the Coccinelle tool. http://coccinelle.lip6.fr/ See for example attached py_clear.spatch semantic patch. Install coccinelle and run spatch -in_place -sp_file py_clear.spatch -dir .. The result is the attached patch (python2.7_pyclear.patch). The patch is huge! Mac/Modules/_scproxy.c |2 +- Mac/Modules/carbonevt/_CarbonEvtmodule.c |3 +- Mac/Modules/list/_Listmodule.c |3 +- Modules/_bsddb.c | 48 - Modules/_ctypes/_ctypes.c| 18 +--- Modules/_elementtree.c |8 +- Modules/_hotshot.c |3 +- Modules/_localemodule.c |3 +- Modules/_sqlite/connection.c |6 +- Modules/_sqlite/cursor.c | 12 +-- Modules/_tkinter.c |6 +- Modules/almodule.c |3 +- Modules/binascii.c | 21 ++ Modules/bz2module.c | 12 +-- Modules/cPickle.c|3 +- Modules/cdmodule.c | 18 +--- Modules/cjkcodecs/multibytecodec.c |3 +- Modules/datetimemodule.c | 12 +-- Modules/flmodule.c | 12 +-- Modules/fmmodule.c |3 +- Modules/nismodule.c |3 +- Modules/posixmodule.c| 33 +++-- Modules/pyexpat.c|6 +- Modules/readline.c |7 +- Modules/selectmodule.c |3 +- Modules/signalmodule.c |9 +- Modules/svmodule.c |3 +- Modules/syslogmodule.c |3 +- Modules/zlibmodule.c | 18 +--- Objects/abstract.c |6 +- Objects/classobject.c| 18 +--- Objects/descrobject.c|3 +- Objects/exceptions.c |3 +- Objects/fileobject.c | 12 +-- Objects/frameobject.c|3 +- Objects/genobject.c |3 +- Objects/longobject.c |3 +- Objects/object.c |6 +- Objects/stringobject.c | 12 +-- Objects/tupleobject.c|6 +- Objects/typeobject.c | 12 +-- Objects/unicodeobject.c | 12 +-- Python/Python-ast.c | 381 ++ Python/bltinmodule.c | 12 +-- Python/errors.c |3 +- Python/import.c |6 +- Python/marshal.c | 12 +-- Python/modsupport.c |3 +- Python/structmember.c|3 +- Python/sysmodule.c |9 +- RISCOS/Modules/drawfmodule.c |2 +- RISCOS/Modules/swimodule.c |2 +- 52 files changed, 275 insertions(+), 541 deletions(-) -- Added file: http://bugs.python.org/file27929/py_clear.spatch ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16445 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16445] SEGFAULT when deleting Exception.message
Changes by STINNER Victor victor.stin...@gmail.com: -- keywords: +patch Added file: http://bugs.python.org/file27930/python27_pyclear.patch ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16445 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16445] SEGFAULT when deleting Exception.message
STINNER Victor added the comment: The spatch doesn't match the following macro: Modules/_testcapimodule.c:#define UNBIND(X) Py_DECREF(X); (X) = NULL -- Python/Python-ast.c is autogenerated from Parser/asdl_c.py, the .py file should be fixed instead. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16445 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16445] SEGFAULT when deleting Exception.message
STINNER Victor added the comment: python27_pyclear.patch does fix the use case described in msg175203, but it doesn't fix #16447. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16445 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16445] SEGFAULT when deleting Exception.message
STINNER Victor added the comment: py_clear.spatch replaces: Py_DECREF(obj-attr); obj-attr = NULL; but also: Py_DECREF(obj); obj = NULL; If the second pattern is not dangerous, py_clear.spatch can be modified to only match the first pattern: see py_decref_replace.spatch of issue #16447 for an example. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16445 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com