[Python-checkins] bpo-25750: fix refcounts in type_getattro() (GH-6118)

Fri Sep 7 03:37:05 EDT 2018

https://github.com/python/cpython/commit/8f735485acf2e35a75d2fa019feb8f905598c4e5
commit: 8f735485acf2e35a75d2fa019feb8f905598c4e5
branch: master
author: jdemeyer <jdemeyer at cage.ugent.be>
committer: Victor Stinner <vstinner at redhat.com>
date: 2018年09月07日T09:37:00+02:00
summary:
bpo-25750: fix refcounts in type_getattro() (GH-6118)
When calling tp_descr_get(self, obj, type), make sure that
we own a strong reference to "self".
files:
A Misc/NEWS.d/next/Core and Builtins/2018-03-14-21-42-17.bpo-25750.lxgkQz.rst
M Objects/typeobject.c

diff --git a/Misc/NEWS.d/next/Core and Builtins/2018-03-14-21-42-17.bpo-25750.lxgkQz.rst b/Misc/NEWS.d/next/Core and Builtins/2018-03-14-21-42-17.bpo-25750.lxgkQz.rst
new file mode 100644
index 000000000000..09ffb368b7c6
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and Builtins/2018-03-14-21-42-17.bpo-25750.lxgkQz.rst	
@@ -0,0 +1,2 @@
+Fix rare Python crash due to bad refcounting in ``type_getattro()`` if a
+descriptor deletes itself from the class. Patch by Jeroen Demeyer.
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 52fcfeb22871..b9e69bf1bd1d 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -3145,6 +3145,7 @@ type_getattro(PyTypeObject *type, PyObject *name)
 PyTypeObject *metatype = Py_TYPE(type);
 PyObject *meta_attribute, *attribute;
 descrgetfunc meta_get;
+ PyObject* res;
 
 if (!PyUnicode_Check(name)) {
 PyErr_Format(PyExc_TypeError,
@@ -3166,6 +3167,7 @@ type_getattro(PyTypeObject *type, PyObject *name)
 meta_attribute = _PyType_Lookup(metatype, name);
 
 if (meta_attribute != NULL) {
+ Py_INCREF(meta_attribute);
 meta_get = Py_TYPE(meta_attribute)->tp_descr_get;
 
 if (meta_get != NULL && PyDescr_IsData(meta_attribute)) {
@@ -3173,10 +3175,11 @@ type_getattro(PyTypeObject *type, PyObject *name)
 * writes. Assume the attribute is not overridden in
 * type's tp_dict (and bases): call the descriptor now.
 */
- return meta_get(meta_attribute, (PyObject *)type,
- (PyObject *)metatype);
+ res = meta_get(meta_attribute, (PyObject *)type,
+ (PyObject *)metatype);
+ Py_DECREF(meta_attribute);
+ return res;
 }
- Py_INCREF(meta_attribute);
 }
 
 /* No data descriptor found on metatype. Look in tp_dict of this
@@ -3184,6 +3187,7 @@ type_getattro(PyTypeObject *type, PyObject *name)
 attribute = _PyType_Lookup(type, name);
 if (attribute != NULL) {
 /* Implement descriptor functionality, if any */
+ Py_INCREF(attribute);
 descrgetfunc local_get = Py_TYPE(attribute)->tp_descr_get;
 
 Py_XDECREF(meta_attribute);
@@ -3191,11 +3195,12 @@ type_getattro(PyTypeObject *type, PyObject *name)
 if (local_get != NULL) {
 /* NULL 2nd argument indicates the descriptor was
 * found on the target object itself (or a base) */
- return local_get(attribute, (PyObject *)NULL,
- (PyObject *)type);
+ res = local_get(attribute, (PyObject *)NULL,
+ (PyObject *)type);
+ Py_DECREF(attribute);
+ return res;
 }
 
- Py_INCREF(attribute);
 return attribute;
 }
 
