diff options
author | Benjamin Peterson <benjamin@python.org> | 2015-07-02 21:18:58 (GMT) |
---|---|---|
committer | Benjamin Peterson <benjamin@python.org> | 2015-07-02 21:18:58 (GMT) |
commit | 42e913aa3a6f777a8d40eb1d020e77906d0b1ba4 (patch) | |
tree | 1de0b065591fa0143f6709dc93a723bddd7babf8 | |
parent | e31db2a8214e338be8873a92f7c40c94a56c7078 (diff) | |
parent | 80f78a3efcd0836c4495a833fc24ef20d9ba19b2 (diff) | |
download | cpython-42e913aa3a6f777a8d40eb1d020e77906d0b1ba4.zip cpython-42e913aa3a6f777a8d40eb1d020e77906d0b1ba4.tar.gz cpython-42e913aa3a6f777a8d40eb1d020e77906d0b1ba4.tar.bz2 |
merge 3.4 (#24552)
-rw-r--r-- | Lib/test/pickletester.py | 12 | ||||
-rw-r--r-- | Misc/NEWS | 2 | ||||
-rw-r--r-- | Modules/_pickle.c | 2 |
3 files changed, 15 insertions, 1 deletions
diff --git a/Lib/test/pickletester.py b/Lib/test/pickletester.py index a0c7a0a..cbe4607 100644 --- a/Lib/test/pickletester.py +++ b/Lib/test/pickletester.py @@ -1039,6 +1039,18 @@ class AbstractPickleTests(unittest.TestCase): self.assertEqual(B(x), B(y), detail) self.assertEqual(x.__dict__, y.__dict__, detail) + def test_newobj_not_class(self): + # Issue 24552 + global SimpleNewObj + save = SimpleNewObj + o = object.__new__(SimpleNewObj) + b = self.dumps(o, 4) + try: + SimpleNewObj = 42 + self.assertRaises((TypeError, pickle.UnpicklingError), self.loads, b) + finally: + SimpleNewObj = save + # Register a type with copyreg, with extension code extcode. Pickle # an object of that type. Check that the resulting pickle uses opcode # (EXT[124]) under proto 2, and not in proto 1. @@ -30,6 +30,8 @@ Core and Builtins Library ------- +- Issue #24552: Fix use after free in an error case of the _pickle module. + - Issue #24514: tarfile now tolerates number fields consisting of only whitespace. diff --git a/Modules/_pickle.c b/Modules/_pickle.c index 2d66f00..44f840d 100644 --- a/Modules/_pickle.c +++ b/Modules/_pickle.c @@ -5279,10 +5279,10 @@ load_newobj_ex(UnpicklerObject *self) if (!PyType_Check(cls)) { Py_DECREF(kwargs); Py_DECREF(args); - Py_DECREF(cls); PyErr_Format(st->UnpicklingError, "NEWOBJ_EX class argument must be a type, not %.200s", Py_TYPE(cls)->tp_name); + Py_DECREF(cls); return -1; } |