Issue #6986: Fix crash in the JSON C accelerator when called with the

wrong parameter types.  Patch by Victor Stinner.

3 files changed, 31 insertions, 6 deletions

diff --git a/Lib/json/tests/test_speedups.py b/Lib/json/tests/test_speedups.py
index 3a84ddf..3f8c108 100644
--- a/Lib/json/tests/test_speedups.py
+++ b/Lib/json/tests/test_speedups.py
@@ -1,8 +1,7 @@
 import decimal
 from unittest import TestCase
 
-from json import decoder
-from json import encoder
+from json import decoder, encoder, scanner
 
 class TestSpeedups(TestCase):
     def test_scanstring(self):
@@ -13,3 +12,13 @@ class TestSpeedups(TestCase):
         self.assertEquals(encoder.encode_basestring_ascii.__module__, "_json")
         self.assertTrue(encoder.encode_basestring_ascii is
                           encoder.c_encode_basestring_ascii)
+
+class TestDecode(TestCase):
+    def test_make_scanner(self):
+        self.assertRaises(AttributeError, scanner.c_make_scanner, 1)
+
+    def test_make_encoder(self):
+        self.assertRaises(TypeError, encoder.c_make_encoder,
+            None,
+            "\xCD\x7D\x3D\x4E\x12\x4C\xF9\x79\xD7\x52\xBA\x82\xF2\x27\x4A\x7D\xA0\xCA\x75",
+            None)
diff --git a/Misc/NEWS b/Misc/NEWS
index 6cc264b..95fae08 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -509,6 +509,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #6986: Fix crash in the JSON C accelerator when called with the
+  wrong parameter types.  Patch by Victor Stinner.
+
 - logging: Added optional `secure` parameter to SMTPHandler, to enable use of
   TLS with authentication credentials.
 
diff --git a/Modules/_json.c b/Modules/_json.c
index 7c8abea..8bd6928 100644
--- a/Modules/_json.c
+++ b/Modules/_json.c
@@ -1731,6 +1731,8 @@ scanner_init(PyObject *self, PyObject *args, PyObject *kwds)
 
     /* PyString_AS_STRING is used on encoding */
     s->encoding = PyObject_GetAttrString(ctx, "encoding");
+    if (s->encoding == NULL)
+        goto bail;
     if (s->encoding == Py_None) {
         Py_DECREF(Py_None);
         s->encoding = PyString_InternFromString(DEFAULT_ENCODING);
@@ -1847,15 +1849,28 @@ encoder_init(PyObject *self, PyObject *args, PyObject *kwds)
     static char *kwlist[] = {"markers", "default", "encoder", "indent", "key_separator", "item_separator", "sort_keys", "skipkeys", "allow_nan", NULL};
 
     PyEncoderObject *s;
-    PyObject *allow_nan;
+    PyObject *markers, *defaultfn, *encoder, *indent, *key_separator;
+    PyObject *item_separator, *sort_keys, *skipkeys, *allow_nan;
 
     assert(PyEncoder_Check(self));
     s = (PyEncoderObject *)self;
 
     if (!PyArg_ParseTupleAndKeywords(args, kwds, "OOOOOOOOO:make_encoder", kwlist,
-        &s->markers, &s->defaultfn, &s->encoder, &s->indent, &s->key_separator, &s->item_separator, &s->sort_keys, &s->skipkeys, &allow_nan))
+        &markers, &defaultfn, &encoder, &indent, &key_separator, &item_separator,
+        &sort_keys, &skipkeys, &allow_nan))
         return -1;
 
+    s->markers = markers;
+    s->defaultfn = defaultfn;
+    s->encoder = encoder;
+    s->indent = indent;
+    s->key_separator = key_separator;
+    s->item_separator = item_separator;
+    s->sort_keys = sort_keys;
+    s->skipkeys = skipkeys;
+    s->fast_encode = (PyCFunction_Check(s->encoder) && PyCFunction_GetFunction(s->encoder) == (PyCFunction)py_encode_basestring_ascii);
+    s->allow_nan = PyObject_IsTrue(allow_nan);
+
     Py_INCREF(s->markers);
     Py_INCREF(s->defaultfn);
     Py_INCREF(s->encoder);
@@ -1864,8 +1879,6 @@ encoder_init(PyObject *self, PyObject *args, PyObject *kwds)
     Py_INCREF(s->item_separator);
     Py_INCREF(s->sort_keys);
     Py_INCREF(s->skipkeys);
-    s->fast_encode = (PyCFunction_Check(s->encoder) && PyCFunction_GetFunction(s->encoder) == (PyCFunction)py_encode_basestring_ascii);
-    s->allow_nan = PyObject_IsTrue(allow_nan);
     return 0;
 }