The _lsprof module could crash the interpreter if it was given an external

timer that did not return a float and a timer was still running when the
Profiler object was garbage collected.

Fixes issue 3895.
Code review by Benjamin Peterson.

1 files changed, 10 insertions, 1 deletions

diff --git a/Modules/_lsprof.c b/Modules/_lsprof.c
index 5d18c33..41c477e 100644
--- a/Modules/_lsprof.c
+++ b/Modules/_lsprof.c
@@ -150,7 +150,16 @@ static PY_LONG_LONG CallExternalTimer(ProfilerObject *pObj)
 	}
 	Py_DECREF(o);
 	if (PyErr_Occurred()) {
-		PyErr_WriteUnraisable((PyObject *) pObj);
+		PyObject *context = (PyObject *)pObj;
+		/* May have been called by profiler_dealloc(). */
+		if (Py_REFCNT(context) < 1) {
+			context = PyString_FromString("profiler calling an "
+							"external timer");
+			if (context == NULL) {
+				return 0;
+			}
+		}
+		PyErr_WriteUnraisable(context);
 		return 0;
 	}
 	return result;