diff options
| author | Christian Heimes <christian@cheimes.de> | 2013-07-01 21:42:28 (GMT) |
|---|---|---|
| committer | Christian Heimes <christian@cheimes.de> | 2013-07-01 21:42:28 (GMT) |
| commit | b9dbc7d6e1ad5700ed0084f63215db97a2c9bcbb (patch) | |
| tree | 2aa99959dd43f44473409e9154e70eef46ec9f6d /Python | |
| parent | 21782488584f7b633f4a6f125e6ba200c016d644 (diff) | |
| download | cpython-b9dbc7d6e1ad5700ed0084f63215db97a2c9bcbb.zip cpython-b9dbc7d6e1ad5700ed0084f63215db97a2c9bcbb.tar.gz cpython-b9dbc7d6e1ad5700ed0084f63215db97a2c9bcbb.tar.bz2 | |
Issue #18328: Reorder ops in PyThreadState_Delete*() functions. Now the
tstate is first removed from TLS and then deallocated.
CID 1019639 (#1 of 1): Use after free (USE_AFTER_FREE)
use_after_free: Using freed pointer tstate.
Diffstat (limited to 'Python')
| -rw-r--r-- | Python/pystate.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/Python/pystate.c b/Python/pystate.c index cfd61d0..772aa53 100644 --- a/Python/pystate.c +++ b/Python/pystate.c @@ -388,11 +388,11 @@ PyThreadState_Delete(PyThreadState *tstate) { if (tstate == _Py_atomic_load_relaxed(&_PyThreadState_Current)) Py_FatalError("PyThreadState_Delete: tstate is still current"); - tstate_delete_common(tstate); #ifdef WITH_THREAD if (autoInterpreterState && PyThread_get_key_value(autoTLSkey) == tstate) PyThread_delete_key_value(autoTLSkey); #endif /* WITH_THREAD */ + tstate_delete_common(tstate); } @@ -406,9 +406,9 @@ PyThreadState_DeleteCurrent() Py_FatalError( "PyThreadState_DeleteCurrent: no current tstate"); _Py_atomic_store_relaxed(&_PyThreadState_Current, NULL); - tstate_delete_common(tstate); if (autoInterpreterState && PyThread_get_key_value(autoTLSkey) == tstate) PyThread_delete_key_value(autoTLSkey); + tstate_delete_common(tstate); PyEval_ReleaseLock(); } #endif /* WITH_THREAD */ |