From 84af903f3bc6780cb4e73ff05ad2e242d3966417 Mon Sep 17 00:00:00 2001 From: Yury Selivanov Date: Thu, 2 Mar 2017 23:46:56 -0500 Subject: bpo-28963: Fix out of bound iteration in asyncio.Future.remove_done_callback/C (#408) --- Lib/test/test_asyncio/test_futures.py | 29 +++++++++++++++++++++++++++++ Misc/NEWS | 3 +++ Modules/_asynciomodule.c | 2 +- 3 files changed, 33 insertions(+), 1 deletion(-) diff --git a/Lib/test/test_asyncio/test_futures.py b/Lib/test/test_asyncio/test_futures.py index 89afdca..99336f8 100644 --- a/Lib/test/test_asyncio/test_futures.py +++ b/Lib/test/test_asyncio/test_futures.py @@ -569,6 +569,35 @@ class BaseFutureDoneCallbackTests(): self.assertEqual(bag, [2]) self.assertEqual(f.result(), 'foo') + def test_remove_done_callbacks_list_mutation(self): + # see http://bugs.python.org/issue28963 for details + + fut = self._new_future() + fut.add_done_callback(str) + + for _ in range(63): + fut.add_done_callback(id) + + class evil: + def __eq__(self, other): + fut.remove_done_callback(id) + return False + + fut.remove_done_callback(evil()) + + def test_schedule_callbacks_list_mutation(self): + # see http://bugs.python.org/issue28963 for details + + def mut(f): + f.remove_done_callback(str) + + fut = self._new_future() + fut.add_done_callback(mut) + fut.add_done_callback(str) + fut.add_done_callback(str) + fut.set_result(1) + test_utils.run_briefly(self.loop) + @unittest.skipUnless(hasattr(futures, '_CFuture'), 'requires the C _asyncio module') diff --git a/Misc/NEWS b/Misc/NEWS index 3c59c75..583d35e 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -259,6 +259,9 @@ Extension Modules Library ------- +- bpo-28963: Fix out of bound iteration in asyncio.Future.remove_done_callback + implemented in C. + - bpo-29704: asyncio.subprocess.SubprocessStreamProtocol no longer closes before all pipes are closed. diff --git a/Modules/_asynciomodule.c b/Modules/_asynciomodule.c index 2204792..e902c04 100644 --- a/Modules/_asynciomodule.c +++ b/Modules/_asynciomodule.c @@ -522,7 +522,7 @@ _asyncio_Future_remove_done_callback(FutureObj *self, PyObject *fn) return NULL; } - for (i = 0; i < len; i++) { + for (i = 0; i < PyList_GET_SIZE(self->fut_callbacks); i++) { int ret; PyObject *item = PyList_GET_ITEM(self->fut_callbacks, i); -- cgit v0.12