diff options
| -rw-r--r-- | Lib/test/test_descr.py | 14 | ||||
| -rw-r--r-- | Misc/NEWS | 3 | ||||
| -rw-r--r-- | Objects/typeobject.c | 5 |
3 files changed, 21 insertions, 1 deletions
diff --git a/Lib/test/test_descr.py b/Lib/test/test_descr.py index b5a10ed..3776389 100644 --- a/Lib/test/test_descr.py +++ b/Lib/test/test_descr.py @@ -3997,6 +3997,20 @@ order (MRO) for bases """ C.__name__ = 'D.E' self.assertEqual((C.__module__, C.__name__), (mod, 'D.E')) + def test_evil_type_name(self): + # A badly placed Py_DECREF in type_set_name led to arbitrary code + # execution while the type structure was not in a sane state, and a + # possible segmentation fault as a result. See bug #16447. + class Nasty(str): + def __del__(self): + C.__name__ = "other" + + class C: + pass + + C.__name__ = Nasty("abc") + C.__name__ = "normal" + def test_subclass_right_op(self): # Testing correct dispatch of subclass overloading __r<op>__... @@ -12,6 +12,9 @@ What's New in Python 3.3.2? Core and Builtins ----------------- +- Issue #16447: Fixed potential segmentation fault when setting __name__ on a + class. + - Issue #17669: Fix crash involving finalization of generators using yield from. - Issue #17619: Make input() check for Ctrl-C correctly on Windows. diff --git a/Objects/typeobject.c b/Objects/typeobject.c index 9f89972..6ece741 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -298,10 +298,13 @@ type_set_name(PyTypeObject *type, PyObject *value, void *context) Py_INCREF(value); - Py_DECREF(et->ht_name); + /* Wait until et is a sane state before Py_DECREF'ing the old et->ht_name + value. (Bug #16447.) */ + tmp = et->ht_name; et->ht_name = value; type->tp_name = tp_name; + Py_DECREF(tmp); return 0; } |