diff options
| author | INADA Naoki <methane@users.noreply.github.com> | 2017-02-12 04:51:30 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2017-02-12 04:51:30 (GMT) |
| commit | 2294f3aee14a6074b17c67ef936c607430bb3c7a (patch) | |
| tree | 3519ef6fe1a64699303a0e93a1aee67c565bb476 /Objects | |
| parent | e7ffb99f842ebff97cffa0fc90b18be4e5abecf2 (diff) | |
| download | cpython-2294f3aee14a6074b17c67ef936c607430bb3c7a.zip cpython-2294f3aee14a6074b17c67ef936c607430bb3c7a.tar.gz cpython-2294f3aee14a6074b17c67ef936c607430bb3c7a.tar.bz2 | |
bpo-29438: fixed use-after-free in key sharing dict (#17)
Diffstat (limited to 'Objects')
| -rw-r--r-- | Objects/dictobject.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/Objects/dictobject.c b/Objects/dictobject.c index 43584b7..5fe5272 100644 --- a/Objects/dictobject.c +++ b/Objects/dictobject.c @@ -4352,15 +4352,19 @@ _PyObjectDict_SetItem(PyTypeObject *tp, PyObject **dictptr, } if (value == NULL) { res = PyDict_DelItem(dict, key); - if (cached != ((PyDictObject *)dict)->ma_keys) { + // Since key sharing dict doesn't allow deletion, PyDict_DelItem() + // always converts dict to combined form. + if ((cached = CACHED_KEYS(tp)) != NULL) { CACHED_KEYS(tp) = NULL; DK_DECREF(cached); } } else { - int was_shared = cached == ((PyDictObject *)dict)->ma_keys; + int was_shared = (cached == ((PyDictObject *)dict)->ma_keys); res = PyDict_SetItem(dict, key, value); - if (was_shared && cached != ((PyDictObject *)dict)->ma_keys) { + if (was_shared && + (cached = CACHED_KEYS(tp)) != NULL && + cached != ((PyDictObject *)dict)->ma_keys) { /* PyDict_SetItem() may call dictresize and convert split table * into combined table. In such case, convert it to split * table again and update type's shared key only when this is |