From 48ad3207775038dbb12f74370c92ed582eb4ddc8 Mon Sep 17 00:00:00 2001 From: "T. Wouters" Date: Fri, 16 Jul 2021 00:40:57 +0200 Subject: [PATCH] bpo-44184: Apply GH-26274 to the non-GC-type branch of subtype_dealloc (GH-27165) The non-GC-type branch of subtype_dealloc is using the type of an object after freeing in the same unsafe way as GH-26274 fixes. (I believe the old news entry covers this change well enough.) https://bugs.python.org/issue44184 (cherry picked from commit 074e7659f208051b6b973f7fdb654dd22b93aaa2) Co-authored-by: T. Wouters --- Objects/typeobject.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/Objects/typeobject.c b/Objects/typeobject.c index acbe3fa3b5a7f1..82faa7987ff506 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -1231,14 +1231,22 @@ subtype_dealloc(PyObject *self) /* Extract the type again; tp_del may have changed it */ type = Py_TYPE(self); + // Don't read type memory after calling basedealloc() since basedealloc() + // can deallocate the type and free its memory. + int type_needs_decref = (type->tp_flags & Py_TPFLAGS_HEAPTYPE + && !(base->tp_flags & Py_TPFLAGS_HEAPTYPE)); + /* Call the base tp_dealloc() */ assert(basedealloc); basedealloc(self); - /* Only decref if the base type is not already a heap allocated type. - Otherwise, basedealloc should have decref'd it already */ - if (type->tp_flags & Py_TPFLAGS_HEAPTYPE && !(base->tp_flags & Py_TPFLAGS_HEAPTYPE)) + /* Can't reference self beyond this point. It's possible tp_del switched + our type from a HEAPTYPE to a non-HEAPTYPE, so be careful about + reference counting. Only decref if the base type is not already a heap + allocated type. Otherwise, basedealloc should have decref'd it already */ + if (type_needs_decref) { Py_DECREF(type); + } /* Done */ return; pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.

Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy