From 64aafeb4de3b5e85007f2107250e6f1da4df2516 Mon Sep 17 00:00:00 2001 From: Mark Dickinson Date: Sat, 13 Apr 2013 15:26:58 +0100 Subject: [PATCH] Issue #16447: Fix potential segfault when setting __name__ on a class. --- Lib/test/test_descr.py | 14 ++++++++++++++ Misc/NEWS | 3 +++ Objects/typeobject.c | 5 ++++- 3 files changed, 21 insertions(+), 1 deletion(-) diff --git a/Lib/test/test_descr.py b/Lib/test/test_descr.py index b5a10edc12e..3776389ebb6 100644 --- a/Lib/test/test_descr.py +++ b/Lib/test/test_descr.py @@ -3997,6 +3997,20 @@ class C(object): C.__name__ = 'D.E' self.assertEqual((C.__module__, C.__name__), (mod, 'D.E')) + def test_evil_type_name(self): + # A badly placed Py_DECREF in type_set_name led to arbitrary code + # execution while the type structure was not in a sane state, and a + # possible segmentation fault as a result. See bug #16447. + class Nasty(str): + def __del__(self): + C.__name__ = "other" + + class C: + pass + + C.__name__ = Nasty("abc") + C.__name__ = "normal" + def test_subclass_right_op(self): # Testing correct dispatch of subclass overloading __r__... diff --git a/Misc/NEWS b/Misc/NEWS index 4bee5b508e6..94a3ed32e9a 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -12,6 +12,9 @@ What's New in Python 3.3.2? Core and Builtins ----------------- +- Issue #16447: Fixed potential segmentation fault when setting __name__ on a + class. + - Issue #17669: Fix crash involving finalization of generators using yield from. - Issue #17619: Make input() check for Ctrl-C correctly on Windows. diff --git a/Objects/typeobject.c b/Objects/typeobject.c index 9f899725942..6ece741833a 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -298,10 +298,13 @@ type_set_name(PyTypeObject *type, PyObject *value, void *context) Py_INCREF(value); - Py_DECREF(et->ht_name); + /* Wait until et is a sane state before Py_DECREF'ing the old et->ht_name + value. (Bug #16447.) */ + tmp = et->ht_name; et->ht_name = value; type->tp_name = tp_name; + Py_DECREF(tmp); return 0; }