diff options
| author | INADA Naoki <methane@users.noreply.github.com> | 2017-02-13 00:19:05 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2017-02-13 00:19:05 (GMT) |
| commit | 89ddffbe9dcb38b79f99563b0d4d594d1105a192 (patch) | |
| tree | 13004834c5f1601549a13abae3bb0ed52a8618c2 /Objects | |
| parent | f66c81ff499fb431e56bc68f5e39c2f7b9fcb6a7 (diff) | |
| download | cpython-89ddffbe9dcb38b79f99563b0d4d594d1105a192.zip cpython-89ddffbe9dcb38b79f99563b0d4d594d1105a192.tar.gz cpython-89ddffbe9dcb38b79f99563b0d4d594d1105a192.tar.bz2 | |
bpo-29438: fixed use-after-free in key sharing dict (#39)
Diffstat (limited to 'Objects')
| -rw-r--r-- | Objects/dictobject.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/Objects/dictobject.c b/Objects/dictobject.c index a7b403b..b63b78a 100644 --- a/Objects/dictobject.c +++ b/Objects/dictobject.c @@ -4376,15 +4376,19 @@ _PyObjectDict_SetItem(PyTypeObject *tp, PyObject **dictptr, } if (value == NULL) { res = PyDict_DelItem(dict, key); - if (cached != ((PyDictObject *)dict)->ma_keys) { + // Since key sharing dict doesn't allow deletion, PyDict_DelItem() + // always converts dict to combined form. + if ((cached = CACHED_KEYS(tp)) != NULL) { CACHED_KEYS(tp) = NULL; DK_DECREF(cached); } } else { - int was_shared = cached == ((PyDictObject *)dict)->ma_keys; + int was_shared = (cached == ((PyDictObject *)dict)->ma_keys); res = PyDict_SetItem(dict, key, value); - if (was_shared && cached != ((PyDictObject *)dict)->ma_keys) { + if (was_shared && + (cached = CACHED_KEYS(tp)) != NULL && + cached != ((PyDictObject *)dict)->ma_keys) { /* PyDict_SetItem() may call dictresize and convert split table * into combined table. In such case, convert it to split * table again and update type's shared key only when this is |