FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

[3.14] gh-143543: Fix re-entrant use-after-free in itertools.groupby (GH-143738) by miss-islington · Pull Request #144626 · python/cpython · GitHub

Repository navigation

Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension .c  (1) .py  (1) .rst  (1) All 3 file types selected
Viewed files
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Unified
Split
Hide whitespace
Diff view
Unified
Split
Hide whitespace
21 changes: 21 additions & 0 deletions Lib/test/test_itertools.py
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Original file line number Diff line number Diff line change
Expand Up @@ -733,6 +733,27 @@ def keyfunc(obj):
keyfunc.skip = 1
self.assertRaises(ExpectedError, gulp, [None, None], keyfunc)

def test_groupby_reentrant_eq_does_not_crash(self):
# regression test for gh-143543
class Key:
def __init__(self, do_advance):
self.do_advance = do_advance

def __eq__(self, other):
if self.do_advance:
self.do_advance = False
next(g)
return NotImplemented
return False

def keys():
yield Key(True)
yield Key(False)

g = itertools.groupby([None, None], keys().send)
next(g)
next(g) # must pass with address sanitizer

def test_filter(self):
self.assertEqual(list(filter(isEven, range(6))), [0,2,4])
self.assertEqual(list(filter(None, [0,1,0,2,0])), [1,2])
Expand Down
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
Fix a crash in itertools.groupby that could occur when a user-defined
:meth:`~object.__eq__` method re-enters the iterator during key comparison.
14 changes: 12 additions & 2 deletions Modules/itertoolsmodule.c
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Original file line number Diff line number Diff line change
Expand Up @@ -544,9 +544,19 @@ groupby_next(PyObject *op)
else if (gbo->tgtkey == NULL)
break;
else {
int rcmp;
/* A user-defined __eq__ can re-enter groupby and advance the iterator,
mutating gbo->tgtkey / gbo->currkey while we are comparing them.
Take local snapshots and hold strong references so INCREF/DECREF
apply to the same objects even under re-entrancy. */
PyObject *tgtkey = gbo->tgtkey;
PyObject *currkey = gbo->currkey;

Py_INCREF(tgtkey);
Py_INCREF(currkey);
int rcmp = PyObject_RichCompareBool(tgtkey, currkey, Py_EQ);
Py_DECREF(tgtkey);
Py_DECREF(currkey);

rcmp = PyObject_RichCompareBool(gbo->tgtkey, gbo->currkey, Py_EQ);
if (rcmp == -1)
return NULL;
else if (rcmp == 0)
Expand Down
Loading

Back | FazBrowse Home | New Git URL