summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorBenjamin Peterson <benjamin@python.org>2015-07-02 21:18:58 (GMT)
committerBenjamin Peterson <benjamin@python.org>2015-07-02 21:18:58 (GMT)
commit42e913aa3a6f777a8d40eb1d020e77906d0b1ba4 (patch)
tree1de0b065591fa0143f6709dc93a723bddd7babf8
parente31db2a8214e338be8873a92f7c40c94a56c7078 (diff)
parent80f78a3efcd0836c4495a833fc24ef20d9ba19b2 (diff)
downloadcpython-42e913aa3a6f777a8d40eb1d020e77906d0b1ba4.zip
cpython-42e913aa3a6f777a8d40eb1d020e77906d0b1ba4.tar.gz
cpython-42e913aa3a6f777a8d40eb1d020e77906d0b1ba4.tar.bz2
merge 3.4 (#24552)
-rw-r--r--Lib/test/pickletester.py12
-rw-r--r--Misc/NEWS2
-rw-r--r--Modules/_pickle.c2
3 files changed, 15 insertions, 1 deletions
diff --git a/Lib/test/pickletester.py b/Lib/test/pickletester.py
index a0c7a0a..cbe4607 100644
--- a/Lib/test/pickletester.py
+++ b/Lib/test/pickletester.py
@@ -1039,6 +1039,18 @@ class AbstractPickleTests(unittest.TestCase):
self.assertEqual(B(x), B(y), detail)
self.assertEqual(x.__dict__, y.__dict__, detail)
+ def test_newobj_not_class(self):
+ # Issue 24552
+ global SimpleNewObj
+ save = SimpleNewObj
+ o = object.__new__(SimpleNewObj)
+ b = self.dumps(o, 4)
+ try:
+ SimpleNewObj = 42
+ self.assertRaises((TypeError, pickle.UnpicklingError), self.loads, b)
+ finally:
+ SimpleNewObj = save
+
# Register a type with copyreg, with extension code extcode. Pickle
# an object of that type. Check that the resulting pickle uses opcode
# (EXT[124]) under proto 2, and not in proto 1.
diff --git a/Misc/NEWS b/Misc/NEWS
index 685ce41..50b1d0e 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -30,6 +30,8 @@ Core and Builtins
Library
-------
+- Issue #24552: Fix use after free in an error case of the _pickle module.
+
- Issue #24514: tarfile now tolerates number fields consisting of only
whitespace.
diff --git a/Modules/_pickle.c b/Modules/_pickle.c
index 2d66f00..44f840d 100644
--- a/Modules/_pickle.c
+++ b/Modules/_pickle.c
@@ -5279,10 +5279,10 @@ load_newobj_ex(UnpicklerObject *self)
if (!PyType_Check(cls)) {
Py_DECREF(kwargs);
Py_DECREF(args);
- Py_DECREF(cls);
PyErr_Format(st->UnpicklingError,
"NEWOBJ_EX class argument must be a type, not %.200s",
Py_TYPE(cls)->tp_name);
+ Py_DECREF(cls);
return -1;
}