Skip to content

bpo-15108: Prevent accessing the result tuple from Python in PySequence_Tuple#24510

Closed
pablogsal wants to merge 1 commit intopython:masterfrom
pablogsal:bpo-15108
Closed

bpo-15108: Prevent accessing the result tuple from Python in PySequence_Tuple#24510
pablogsal wants to merge 1 commit intopython:masterfrom
pablogsal:bpo-15108

Conversation

@pablogsal
Copy link
Copy Markdown
Member

@pablogsal pablogsal commented Feb 12, 2021 •
edited by bedevere-bot
Loading

@pablogsal pablogsal requested review from pitrou and vstinner February 12, 2021 01:00
vstinner
vstinner reviewed Feb 15, 2021
View reviewed changes
Comment thread Objects/abstract.c

// bpo-15108: Code can access the result tuple while being
// incomplete when calling PyIter_Next().
PyObject_GC_UnTrack(result);
Copy link
Copy Markdown
Member

@vstinner vstinner Feb 15, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would prefer to add a new API to create an untracked tuple: https://bugs.python.org/issue15108#msg387029

Copy link
Copy Markdown
Member Author

@pablogsal pablogsal Feb 15, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's discuss int the issue, then I can modify the PR :)

@rhettinger
Copy link
Copy Markdown
Contributor

rhettinger commented Feb 22, 2021

FWIW: Traditionally any "crasher" that depended on gc.get_referrers was not considered a bug. These do not seem to affect "normal code" and are hard to fix without doing brain surgery to Python.

@pablogsal
Copy link
Copy Markdown
Member Author

pablogsal commented Feb 22, 2021

Yeah, I have to say that I am not very convinced about this change because it also fixes a bigger problem only on one place.

What worries me the most here is not using gc.get_referrers, but the GC crashing because it does a GC pass when the tuple is invalid.

@pablogsal pablogsal closed this Feb 22, 2021
@pablogsal pablogsal deleted the bpo-15108 branch May 19, 2021 18:59
@pxd pxd mannequin mentioned this pull request Aug 14, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vstinner vstinner vstinner left review comments

@pitrou pitrou Awaiting requested review from pitrou

Assignees

No one assigned

Labels

awaiting core review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@pablogsal @rhettinger @vstinner @the-knights-who-say-ni @bedevere-bot