diff options
| author | Antoine Pitrou <solipsis@pitrou.net> | 2012-11-01 18:59:21 (GMT) |
|---|---|---|
| committer | Antoine Pitrou <solipsis@pitrou.net> | 2012-11-01 18:59:21 (GMT) |
| commit | 5ebe65f8cb541b10f07fb6ce2b4283a26c7e1d80 (patch) | |
| tree | eb43876e2c023c255b26cb6d79b188079f573f6f | |
| parent | 90c0eb28c5ff1da76b258f9cf6a54abc6df19675 (diff) | |
| parent | 9f69e79c450c3c17172046f937941e6df1802a6d (diff) | |
| download | cpython-5ebe65f8cb541b10f07fb6ce2b4283a26c7e1d80.zip cpython-5ebe65f8cb541b10f07fb6ce2b4283a26c7e1d80.tar.gz cpython-5ebe65f8cb541b10f07fb6ce2b4283a26c7e1d80.tar.bz2 | |
Issue #16228: Fix a crash in the json module where a list changes size while it is being encoded.
Patch by Serhiy Storchaka.
| -rw-r--r-- | Lib/test/json_tests/test_dump.py | 8 | ||||
| -rw-r--r-- | Misc/NEWS | 3 | ||||
| -rw-r--r-- | Modules/_json.c | 10 |
3 files changed, 14 insertions, 7 deletions
diff --git a/Lib/test/json_tests/test_dump.py b/Lib/test/json_tests/test_dump.py index 4b3386f..237ee35 100644 --- a/Lib/test/json_tests/test_dump.py +++ b/Lib/test/json_tests/test_dump.py @@ -20,6 +20,14 @@ class TestDump: {2: 3.0, 4.0: 5, False: 1, 6: True}, sort_keys=True), '{"false": 1, "2": 3.0, "4.0": 5, "6": true}') + # Issue 16228: Crash on encoding resized list + def test_encode_mutated(self): + a = [object()] * 10 + def crasher(obj): + del a[-1] + self.assertEqual(self.dumps(a, default=crasher), + '[null, null, null, null, null]') + class TestPyDump(TestDump, PyTest): pass @@ -61,6 +61,9 @@ Core and Builtins Library ------- +- Issue #16228: Fix a crash in the json module where a list changes size + while it is being encoded. Patch by Serhiy Storchaka. + - Issue #14897: Enhance error messages of struct.pack and struct.pack_into. Patch by Matti Mäki. diff --git a/Modules/_json.c b/Modules/_json.c index fb8bd59..5b42f6f 100644 --- a/Modules/_json.c +++ b/Modules/_json.c @@ -1660,8 +1660,6 @@ encoder_listencode_list(PyEncoderObject *s, _PyAccu *acc, static PyObject *empty_array = NULL; PyObject *ident = NULL; PyObject *s_fast = NULL; - Py_ssize_t num_items; - PyObject **seq_items; Py_ssize_t i; if (open_array == NULL || close_array == NULL || empty_array == NULL) { @@ -1675,8 +1673,7 @@ encoder_listencode_list(PyEncoderObject *s, _PyAccu *acc, s_fast = PySequence_Fast(seq, "_iterencode_list needs a sequence"); if (s_fast == NULL) return -1; - num_items = PySequence_Fast_GET_SIZE(s_fast); - if (num_items == 0) { + if (PySequence_Fast_GET_SIZE(s_fast) == 0) { Py_DECREF(s_fast); return _PyAccu_Accumulate(acc, empty_array); } @@ -1697,7 +1694,6 @@ encoder_listencode_list(PyEncoderObject *s, _PyAccu *acc, } } - seq_items = PySequence_Fast_ITEMS(s_fast); if (_PyAccu_Accumulate(acc, open_array)) goto bail; if (s->indent != Py_None) { @@ -1709,8 +1705,8 @@ encoder_listencode_list(PyEncoderObject *s, _PyAccu *acc, buf += newline_indent */ } - for (i = 0; i < num_items; i++) { - PyObject *obj = seq_items[i]; + for (i = 0; i < PySequence_Fast_GET_SIZE(s_fast); i++) { + PyObject *obj = PySequence_Fast_GET_ITEM(s_fast, i); if (i) { if (_PyAccu_Accumulate(acc, s->item_separator)) goto bail; |