Skip to content

gh-97591: In Exception.__setstate__(), acquire strong reference before calling tp_hash slot.#97700

Merged
gvanrossum merged 4 commits intopython:mainfrom
ofey404:ofey404/gh-97591-exception-setstate-strong-reference
Oct 2, 2022
Merged

gh-97591: In Exception.__setstate__(), acquire strong reference before calling tp_hash slot.#97700
gvanrossum merged 4 commits intopython:mainfrom
ofey404:ofey404/gh-97591-exception-setstate-strong-reference

Conversation

@ofey404
Copy link
Contributor

@ofey404 ofey404 commented Oct 1, 2022 •
edited
Loading

Added an Py_INCREF / Py_DECREF pair around the call of tp_hash slot in Exception.__setstate__().

If the last reference of dict value is cleared (by dict.clear()), during the __setstate__ method call, it would cause gc crash.

A script to reproduce this is in #97591 :

import gc

class Key(str):
    def __hash__(self):
        d.clear()
        return 0

class Value(str):
    pass

d = {}
d[Key()] = Value()

e = Exception()
e.__setstate__(d)

gc.collect() # Segfault happens here

Similiar issue: #92930

Loading
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gvanrossum gvanrossum gvanrossum approved these changes

@iritkatriel iritkatriel Awaiting requested review from iritkatriel iritkatriel is a code owner

Assignees

No one assigned

Labels

type-bug An unexpected behavior, bug, or error type-crash A hard crash of the interpreter, possibly with a core dump

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@ofey404 @miss-islington @bedevere-bot @gvanrossum @kumaraditya303