diff options
| author | Benjamin Peterson <benjamin@python.org> | 2010-09-11 16:03:33 (GMT) |
|---|---|---|
| committer | Benjamin Peterson <benjamin@python.org> | 2010-09-11 16:03:33 (GMT) |
| commit | 8042f4af29d91eb776b143105636bc8099b4b1bc (patch) | |
| tree | ae50b4cdce369eca77775ce35da14c74d56b4483 | |
| parent | 40f7e11f12590beb6486a40be8f9f60e5676c176 (diff) | |
| download | cpython-8042f4af29d91eb776b143105636bc8099b4b1bc.zip cpython-8042f4af29d91eb776b143105636bc8099b4b1bc.tar.gz cpython-8042f4af29d91eb776b143105636bc8099b4b1bc.tar.bz2 | |
Merged revisions 84714 via svnmerge from
svn+ssh://pythondev@svn.python.org/python/branches/py3k
........
r84714 | benjamin.peterson | 2010-09-11 11:02:03 -0500 (Sat, 11 Sep 2010) | 1 line
check for NULL tp_as_mapping in PySequence_(Get/Set/Del)Slice #9834
........
| -rw-r--r-- | Misc/NEWS | 4 | ||||
| -rw-r--r-- | Objects/abstract.c | 6 |
2 files changed, 7 insertions, 3 deletions
@@ -105,6 +105,10 @@ Core and Builtins C-API ----- +- Issue #9834: Don't segfault in PySequence_GetSlice, PySequence_SetSlice, or + PySequence_DelSlice when the object doesn't have any mapping operations + defined. + - Issue #5753: A new C API function, :cfunc:`PySys_SetArgvEx`, allows embedders of the interpreter to set sys.argv without also modifying sys.path. This helps fix `CVE-2008-5983 diff --git a/Objects/abstract.c b/Objects/abstract.c index 3698250..2d4f2e1 100644 --- a/Objects/abstract.c +++ b/Objects/abstract.c @@ -1623,7 +1623,7 @@ PySequence_GetSlice(PyObject *s, Py_ssize_t i1, Py_ssize_t i2) if (!s) return null_error(); mp = s->ob_type->tp_as_mapping; - if (mp->mp_subscript) { + if (mp && mp->mp_subscript) { PyObject *res; PyObject *slice = _PySlice_FromIndices(i1, i2); if (!slice) @@ -1701,7 +1701,7 @@ PySequence_SetSlice(PyObject *s, Py_ssize_t i1, Py_ssize_t i2, PyObject *o) } mp = s->ob_type->tp_as_mapping; - if (mp->mp_ass_subscript) { + if (mp && mp->mp_ass_subscript) { int res; PyObject *slice = _PySlice_FromIndices(i1, i2); if (!slice) @@ -1726,7 +1726,7 @@ PySequence_DelSlice(PyObject *s, Py_ssize_t i1, Py_ssize_t i2) } mp = s->ob_type->tp_as_mapping; - if (mp->mp_ass_subscript) { + if (mp && mp->mp_ass_subscript) { int res; PyObject *slice = _PySlice_FromIndices(i1, i2); if (!slice) |