[Python-checkins] cpython (2.7): Issue #16228: Fix a crash in the json module where a list changes size while it

Thu Nov 1 20:08:21 CET 2012

http://hg.python.org/cpython/rev/33ae62a4ecf5
changeset: 80160:33ae62a4ecf5
branch: 2.7
parent: 80136:8296b686c6de
user: Antoine Pitrou <solipsis at pitrou.net>
date: Thu Nov 01 20:07:40 2012 +0100
summary:
 Issue #16228: Fix a crash in the json module where a list changes size while it is being encoded.
Patch by Serhiy Storchaka.
files:
 Lib/json/tests/test_dump.py | 9 +++++++++
 Misc/NEWS | 3 +++
 Modules/_json.c | 10 +++-------
 3 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/Lib/json/tests/test_dump.py b/Lib/json/tests/test_dump.py
--- a/Lib/json/tests/test_dump.py
+++ b/Lib/json/tests/test_dump.py
@@ -19,5 +19,14 @@
 {2: 3.0, 4.0: 5L, False: 1, 6L: True}, sort_keys=True),
 '{"false": 1, "2": 3.0, "4.0": 5, "6": true}')
 
+ # Issue 16228: Crash on encoding resized list
+ def test_encode_mutated(self):
+ a = [object()] * 10
+ def crasher(obj):
+ del a[-1]
+ self.assertEqual(self.dumps(a, default=crasher),
+ '[null, null, null, null, null]')
+
+
 class TestPyDump(TestDump, PyTest): pass
 class TestCDump(TestDump, CTest): pass
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -130,6 +130,9 @@
 Library
 -------
 
+- Issue #16228: Fix a crash in the json module where a list changes size
+ while it is being encoded. Patch by Serhiy Storchaka.
+
 - Issue #14897: Enhance error messages of struct.pack and
 struct.pack_into. Patch by Matti Mäki.
 
diff --git a/Modules/_json.c b/Modules/_json.c
--- a/Modules/_json.c
+++ b/Modules/_json.c
@@ -2224,8 +2224,6 @@
 static PyObject *empty_array = NULL;
 PyObject *ident = NULL;
 PyObject *s_fast = NULL;
- Py_ssize_t num_items;
- PyObject **seq_items;
 Py_ssize_t i;
 
 if (open_array == NULL || close_array == NULL || empty_array == NULL) {
@@ -2239,8 +2237,7 @@
 s_fast = PySequence_Fast(seq, "_iterencode_list needs a sequence");
 if (s_fast == NULL)
 return -1;
- num_items = PySequence_Fast_GET_SIZE(s_fast);
- if (num_items == 0) {
+ if (PySequence_Fast_GET_SIZE(s_fast) == 0) {
 Py_DECREF(s_fast);
 return PyList_Append(rval, empty_array);
 }
@@ -2261,7 +2258,6 @@
 }
 }
 
- seq_items = PySequence_Fast_ITEMS(s_fast);
 if (PyList_Append(rval, open_array))
 goto bail;
 if (s->indent != Py_None) {
@@ -2273,8 +2269,8 @@
 buf += newline_indent
 */
 }
- for (i = 0; i < num_items; i++) {
- PyObject *obj = seq_items[i];
+ for (i = 0; i < PySequence_Fast_GET_SIZE(s_fast); i++) {
+ PyObject *obj = PySequence_Fast_GET_ITEM(s_fast, i);
 if (i) {
 if (PyList_Append(rval, s->item_separator))
 goto bail;
-- 
Repository URL: http://hg.python.org/cpython
