diff options
| -rw-r--r-- | Lib/test/test_exceptions.py | 12 | ||||
| -rw-r--r-- | Misc/NEWS | 3 | ||||
| -rw-r--r-- | Objects/exceptions.c | 3 |
3 files changed, 16 insertions, 2 deletions
diff --git a/Lib/test/test_exceptions.py b/Lib/test/test_exceptions.py index 216064161c..a485cba893 100644 --- a/Lib/test/test_exceptions.py +++ b/Lib/test/test_exceptions.py @@ -479,6 +479,18 @@ class ExceptionTests(unittest.TestCase): except AssertionError as e: self.assertEqual(str(e), "(3,)") + def test_bad_exception_clearing(self): + # See issue 16445: use of Py_XDECREF instead of Py_CLEAR in + # BaseException_set_message gave a possible way to segfault the + # interpreter. + class Nasty(str): + def __del__(message): + del e.message + + e = ValueError(Nasty("msg")) + e.args = () + del e.message + # Helper class used by TestSameStrAndUnicodeMsg class ExcWithOverriddenStr(Exception): @@ -9,6 +9,9 @@ What's New in Python 2.7.4 Core and Builtins ----------------- +- Issue #16445: Fixed potential segmentation fault when deleting an exception + message. + - Issue #17275: Corrected class name in init error messages of the C version of BufferedWriter and BufferedRandom. diff --git a/Objects/exceptions.c b/Objects/exceptions.c index 49f6d30cd3..0f86cfb194 100644 --- a/Objects/exceptions.c +++ b/Objects/exceptions.c @@ -349,8 +349,7 @@ BaseException_set_message(PyBaseExceptionObject *self, PyObject *val) if (PyDict_DelItemString(self->dict, "message") < 0) return -1; } - Py_XDECREF(self->message); - self->message = NULL; + Py_CLEAR(self->message); return 0; } |