diff options
| -rw-r--r-- | Lib/test/pickletester.py | 12 | ||||
| -rw-r--r-- | Misc/NEWS | 2 | ||||
| -rw-r--r-- | Modules/_pickle.c | 2 |
3 files changed, 15 insertions, 1 deletions
diff --git a/Lib/test/pickletester.py b/Lib/test/pickletester.py index a0c7a0a..cbe4607 100644 --- a/Lib/test/pickletester.py +++ b/Lib/test/pickletester.py @@ -1039,6 +1039,18 @@ class AbstractPickleTests(unittest.TestCase): self.assertEqual(B(x), B(y), detail) self.assertEqual(x.__dict__, y.__dict__, detail) + def test_newobj_not_class(self): + # Issue 24552 + global SimpleNewObj + save = SimpleNewObj + o = object.__new__(SimpleNewObj) + b = self.dumps(o, 4) + try: + SimpleNewObj = 42 + self.assertRaises((TypeError, pickle.UnpicklingError), self.loads, b) + finally: + SimpleNewObj = save + # Register a type with copyreg, with extension code extcode. Pickle # an object of that type. Check that the resulting pickle uses opcode # (EXT[124]) under proto 2, and not in proto 1. @@ -30,6 +30,8 @@ Core and Builtins Library ------- +- Issue #24552: Fix use after free in an error case of the _pickle module. + - Issue #24514: tarfile now tolerates number fields consisting of only whitespace. diff --git a/Modules/_pickle.c b/Modules/_pickle.c index 2d66f00..44f840d 100644 --- a/Modules/_pickle.c +++ b/Modules/_pickle.c @@ -5279,10 +5279,10 @@ load_newobj_ex(UnpicklerObject *self) if (!PyType_Check(cls)) { Py_DECREF(kwargs); Py_DECREF(args); - Py_DECREF(cls); PyErr_Format(st->UnpicklingError, "NEWOBJ_EX class argument must be a type, not %.200s", Py_TYPE(cls)->tp_name); + Py_DECREF(cls); return -1; } |