use %R format code; fixes invalid dereferencing #10391

4 files changed, 43 insertions, 58 deletions

diff --git a/Lib/test/test_ast.py b/Lib/test/test_ast.py
index b5295ef..75af646 100644
--- a/Lib/test/test_ast.py
+++ b/Lib/test/test_ast.py
@@ -197,6 +197,13 @@ class AST_Tests(unittest.TestCase):
                     ast2 = mod.loads(mod.dumps(ast, protocol))
                     self.assertEquals(to_tuple(ast2), to_tuple(ast))
 
+    def test_invalid_sum(self):
+        pos = dict(lineno=2, col_offset=3)
+        m = ast.Module([ast.Expr(ast.expr(**pos), **pos)])
+        with self.assertRaises(TypeError) as cm:
+            compile(m, "<test>", "exec")
+        self.assertIn("but got <_ast.expr", str(cm.exception))
+
 
 class ASTHelpers_Test(unittest.TestCase):
 
diff --git a/Misc/NEWS b/Misc/NEWS
index 8ab404d..138f0f5 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@ What's New in Python 3.2 Beta 1?
 Core and Builtins
 -----------------
 
+- Issue #10391: Don't dereference invalid memory in error messages in the ast
+  module.
+
 - Issue #9518: Extend the PyModuleDef_HEAD_INIT macro to explicitly
   zero-initialize all fields, fixing compiler warnings seen when building
   extension modules with gcc with "-Wmissing-field-initializers" (implied
diff --git a/Parser/asdl_c.py b/Parser/asdl_c.py
index c71c4ef..1fdc6bc 100755
--- a/Parser/asdl_c.py
+++ b/Parser/asdl_c.py
@@ -366,19 +366,19 @@ class Obj2ModVisitor(PickleVisitor):
         self.emit("obj2ast_%s(PyObject* obj, %s* out, PyArena* arena)" % (name, ctype), 0)
         self.emit("{", 0)
         self.emit("PyObject* tmp = NULL;", 1)
+        # Prevent compiler warnings about unused variable.
+        self.emit("tmp = tmp;", 1)
         self.emit("int isinstance;", 1)
         self.emit("", 0)
 
-    def sumTrailer(self, name):
+    def sumTrailer(self, name, add_label=False):
         self.emit("", 0)
-        self.emit("tmp = PyObject_Repr(obj);", 1)
         # there's really nothing more we can do if this fails ...
-        self.emit("if (tmp == NULL) goto failed;", 1)
-        error = "expected some sort of %s, but got %%.400s" % name
-        format = "PyErr_Format(PyExc_TypeError, \"%s\", PyBytes_AS_STRING(tmp));"
+        error = "expected some sort of %s, but got %%R" % name
+        format = "PyErr_Format(PyExc_TypeError, \"%s\", obj);"
         self.emit(format % error, 1, reflow=False)
-        self.emit("failed:", 0)
-        self.emit("Py_XDECREF(tmp);", 1)
+        if add_label:
+            self.emit("failed:", 1)
         self.emit("return 1;", 1)
         self.emit("}", 0)
         self.emit("", 0)
@@ -430,7 +430,7 @@ class Obj2ModVisitor(PickleVisitor):
             self.emit("if (*out == NULL) goto failed;", 2)
             self.emit("return 0;", 2)
             self.emit("}", 1)
-        self.sumTrailer(name)
+        self.sumTrailer(name, True)
 
     def visitAttributeDeclaration(self, a, name, sum=sum):
         ctype = get_c_type(a.type)
diff --git a/Python/Python-ast.c b/Python/Python-ast.c
index c37dda7..7f22f7f 100644
--- a/Python/Python-ast.c
+++ b/Python/Python-ast.c
@@ -3375,6 +3375,7 @@ int
 obj2ast_mod(PyObject* obj, mod_ty* out, PyArena* arena)
 {
         PyObject* tmp = NULL;
+        tmp = tmp;
         int isinstance;
 
 
@@ -3514,11 +3515,8 @@ obj2ast_mod(PyObject* obj, mod_ty* out, PyArena* arena)
                 return 0;
         }
 
-        tmp = PyObject_Repr(obj);
-        if (tmp == NULL) goto failed;
-        PyErr_Format(PyExc_TypeError, "expected some sort of mod, but got %.400s", PyBytes_AS_STRING(tmp));
-failed:
-        Py_XDECREF(tmp);
+        PyErr_Format(PyExc_TypeError, "expected some sort of mod, but got %R", obj);
+        failed:
         return 1;
 }
 
@@ -3526,6 +3524,7 @@ int
 obj2ast_stmt(PyObject* obj, stmt_ty* out, PyArena* arena)
 {
         PyObject* tmp = NULL;
+        tmp = tmp;
         int isinstance;
 
         int lineno;
@@ -4712,11 +4711,8 @@ obj2ast_stmt(PyObject* obj, stmt_ty* out, PyArena* arena)
                 return 0;
         }
 
-        tmp = PyObject_Repr(obj);
-        if (tmp == NULL) goto failed;
-        PyErr_Format(PyExc_TypeError, "expected some sort of stmt, but got %.400s", PyBytes_AS_STRING(tmp));
-failed:
-        Py_XDECREF(tmp);
+        PyErr_Format(PyExc_TypeError, "expected some sort of stmt, but got %R", obj);
+        failed:
         return 1;
 }
 
@@ -4724,6 +4720,7 @@ int
 obj2ast_expr(PyObject* obj, expr_ty* out, PyArena* arena)
 {
         PyObject* tmp = NULL;
+        tmp = tmp;
         int isinstance;
 
         int lineno;
@@ -5830,11 +5827,8 @@ obj2ast_expr(PyObject* obj, expr_ty* out, PyArena* arena)
                 return 0;
         }
 
-        tmp = PyObject_Repr(obj);
-        if (tmp == NULL) goto failed;
-        PyErr_Format(PyExc_TypeError, "expected some sort of expr, but got %.400s", PyBytes_AS_STRING(tmp));
-failed:
-        Py_XDECREF(tmp);
+        PyErr_Format(PyExc_TypeError, "expected some sort of expr, but got %R", obj);
+        failed:
         return 1;
 }
 
@@ -5842,6 +5836,7 @@ int
 obj2ast_expr_context(PyObject* obj, expr_context_ty* out, PyArena* arena)
 {
         PyObject* tmp = NULL;
+        tmp = tmp;
         int isinstance;
 
         isinstance = PyObject_IsInstance(obj, (PyObject *)Load_type);
@@ -5893,11 +5888,7 @@ obj2ast_expr_context(PyObject* obj, expr_context_ty* out, PyArena* arena)
                 return 0;
         }
 
-        tmp = PyObject_Repr(obj);
-        if (tmp == NULL) goto failed;
-        PyErr_Format(PyExc_TypeError, "expected some sort of expr_context, but got %.400s", PyBytes_AS_STRING(tmp));
-failed:
-        Py_XDECREF(tmp);
+        PyErr_Format(PyExc_TypeError, "expected some sort of expr_context, but got %R", obj);
         return 1;
 }
 
@@ -5905,6 +5896,7 @@ int
 obj2ast_slice(PyObject* obj, slice_ty* out, PyArena* arena)
 {
         PyObject* tmp = NULL;
+        tmp = tmp;
         int isinstance;
 
 
@@ -6018,11 +6010,8 @@ obj2ast_slice(PyObject* obj, slice_ty* out, PyArena* arena)
                 return 0;
         }
 
-        tmp = PyObject_Repr(obj);
-        if (tmp == NULL) goto failed;
-        PyErr_Format(PyExc_TypeError, "expected some sort of slice, but got %.400s", PyBytes_AS_STRING(tmp));
-failed:
-        Py_XDECREF(tmp);
+        PyErr_Format(PyExc_TypeError, "expected some sort of slice, but got %R", obj);
+        failed:
         return 1;
 }
 
@@ -6030,6 +6019,7 @@ int
 obj2ast_boolop(PyObject* obj, boolop_ty* out, PyArena* arena)
 {
         PyObject* tmp = NULL;
+        tmp = tmp;
         int isinstance;
 
         isinstance = PyObject_IsInstance(obj, (PyObject *)And_type);
@@ -6049,11 +6039,7 @@ obj2ast_boolop(PyObject* obj, boolop_ty* out, PyArena* arena)
                 return 0;
         }
 
-        tmp = PyObject_Repr(obj);
-        if (tmp == NULL) goto failed;
-        PyErr_Format(PyExc_TypeError, "expected some sort of boolop, but got %.400s", PyBytes_AS_STRING(tmp));
-failed:
-        Py_XDECREF(tmp);
+        PyErr_Format(PyExc_TypeError, "expected some sort of boolop, but got %R", obj);
         return 1;
 }
 
@@ -6061,6 +6047,7 @@ int
 obj2ast_operator(PyObject* obj, operator_ty* out, PyArena* arena)
 {
         PyObject* tmp = NULL;
+        tmp = tmp;
         int isinstance;
 
         isinstance = PyObject_IsInstance(obj, (PyObject *)Add_type);
@@ -6160,11 +6147,7 @@ obj2ast_operator(PyObject* obj, operator_ty* out, PyArena* arena)
                 return 0;
         }
 
-        tmp = PyObject_Repr(obj);
-        if (tmp == NULL) goto failed;
-        PyErr_Format(PyExc_TypeError, "expected some sort of operator, but got %.400s", PyBytes_AS_STRING(tmp));
-failed:
-        Py_XDECREF(tmp);
+        PyErr_Format(PyExc_TypeError, "expected some sort of operator, but got %R", obj);
         return 1;
 }
 
@@ -6172,6 +6155,7 @@ int
 obj2ast_unaryop(PyObject* obj, unaryop_ty* out, PyArena* arena)
 {
         PyObject* tmp = NULL;
+        tmp = tmp;
         int isinstance;
 
         isinstance = PyObject_IsInstance(obj, (PyObject *)Invert_type);
@@ -6207,11 +6191,7 @@ obj2ast_unaryop(PyObject* obj, unaryop_ty* out, PyArena* arena)
                 return 0;
         }
 
-        tmp = PyObject_Repr(obj);
-        if (tmp == NULL) goto failed;
-        PyErr_Format(PyExc_TypeError, "expected some sort of unaryop, but got %.400s", PyBytes_AS_STRING(tmp));
-failed:
-        Py_XDECREF(tmp);
+        PyErr_Format(PyExc_TypeError, "expected some sort of unaryop, but got %R", obj);
         return 1;
 }
 
@@ -6219,6 +6199,7 @@ int
 obj2ast_cmpop(PyObject* obj, cmpop_ty* out, PyArena* arena)
 {
         PyObject* tmp = NULL;
+        tmp = tmp;
         int isinstance;
 
         isinstance = PyObject_IsInstance(obj, (PyObject *)Eq_type);
@@ -6302,11 +6283,7 @@ obj2ast_cmpop(PyObject* obj, cmpop_ty* out, PyArena* arena)
                 return 0;
         }
 
-        tmp = PyObject_Repr(obj);
-        if (tmp == NULL) goto failed;
-        PyErr_Format(PyExc_TypeError, "expected some sort of cmpop, but got %.400s", PyBytes_AS_STRING(tmp));
-failed:
-        Py_XDECREF(tmp);
+        PyErr_Format(PyExc_TypeError, "expected some sort of cmpop, but got %R", obj);
         return 1;
 }
 
@@ -6378,6 +6355,7 @@ int
 obj2ast_excepthandler(PyObject* obj, excepthandler_ty* out, PyArena* arena)
 {
         PyObject* tmp = NULL;
+        tmp = tmp;
         int isinstance;
 
         int lineno;
@@ -6473,11 +6451,8 @@ obj2ast_excepthandler(PyObject* obj, excepthandler_ty* out, PyArena* arena)
                 return 0;
         }
 
-        tmp = PyObject_Repr(obj);
-        if (tmp == NULL) goto failed;
-        PyErr_Format(PyExc_TypeError, "expected some sort of excepthandler, but got %.400s", PyBytes_AS_STRING(tmp));
-failed:
-        Py_XDECREF(tmp);
+        PyErr_Format(PyExc_TypeError, "expected some sort of excepthandler, but got %R", obj);
+        failed:
         return 1;
 }