diff options
| author |   Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2019-12-30 11:51:06 -0800 |
|---|---|---|
| committer |   GitHub <noreply@github.com> | 2019-12-30 11:51:06 -0800 |
| commit | fcaf14cd9179bb48850f8f81ce8d5cee28129745 (patch) | |
| tree | e8281cbb027c504902c686e84d818fd9a1f6047a /Objects | |
| parent | bpo-39037: Fix lookup order of magic methods in with statement documentation ... (diff) | |
| download | cpython-fcaf14cd9179bb48850f8f81ce8d5cee28129745.tar.gz cpython-fcaf14cd9179bb48850f8f81ce8d5cee28129745.tar.bz2 cpython-fcaf14cd9179bb48850f8f81ce8d5cee28129745.zip | |
bpo-38610: Fix possible crashes in several list methods (GH-17022)
Hold strong references to list elements while calling PyObject_RichCompareBool().
(cherry picked from commit d9e561d23d994e3ed15f4fcbd7ee5c8fe50f190b)
Co-authored-by: Zackery Spytz <zspytz@gmail.com>
Diffstat (limited to 'Objects')
| -rw-r--r-- | Objects/listobject.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/Objects/listobject.c b/Objects/listobject.c index f8bf45e5f8c..8b52fa5ef26 100644 --- a/Objects/listobject.c +++ b/Objects/listobject.c @@ -2555,7 +2555,10 @@ list_index_impl(PyListObject *self, PyObject *value, Py_ssize_t start, stop = 0; } for (i = start; i < stop && i < Py_SIZE(self); i++) { - int cmp = PyObject_RichCompareBool(self->ob_item[i], value, Py_EQ); + PyObject *obj = self->ob_item[i]; + Py_INCREF(obj); + int cmp = PyObject_RichCompareBool(obj, value, Py_EQ); + Py_DECREF(obj); if (cmp > 0) return PyLong_FromSsize_t(i); else if (cmp < 0) @@ -2582,7 +2585,10 @@ list_count(PyListObject *self, PyObject *value) Py_ssize_t i; for (i = 0; i < Py_SIZE(self); i++) { - int cmp = PyObject_RichCompareBool(self->ob_item[i], value, Py_EQ); + PyObject *obj = self->ob_item[i]; + Py_INCREF(obj); + int cmp = PyObject_RichCompareBool(obj, value, Py_EQ); + Py_DECREF(obj); if (cmp > 0) count++; else if (cmp < 0) @@ -2609,7 +2615,10 @@ list_remove(PyListObject *self, PyObject *value) Py_ssize_t i; for (i = 0; i < Py_SIZE(self); i++) { - int cmp = PyObject_RichCompareBool(self->ob_item[i], value, Py_EQ); + PyObject *obj = self->ob_item[i]; + Py_INCREF(obj); + int cmp = PyObject_RichCompareBool(obj, value, Py_EQ); + Py_DECREF(obj); if (cmp > 0) { if (list_ass_slice(self, i, i+1, (PyObject *)NULL) == 0) |