diff options
| author | Dong-hee Na <donghee.na92@gmail.com> | 2019-12-31 10:04:22 +0900 |
|---|---|---|
| committer | Pablo Galindo <Pablogsal@gmail.com> | 2019-12-31 01:04:22 +0000 |
| commit | 2d5bf568eaa5059402ccce9ba5a366986ba27c8a (patch) | |
| tree | 04fe688caaa82e948cc4ff315fe82453f3445b6e /Objects/listobject.c | |
| parent | ee9ff05ec22ecd47dbffdd361967ccd55963dad2 (diff) | |
| download | cpython-git-2d5bf568eaa5059402ccce9ba5a366986ba27c8a.tar.gz | |
bpo-38588: Fix possible crashes in dict and list when calling PyObject_RichCompareBool (GH-17734)
Take strong references before calling PyObject_RichCompareBool to protect against the case
where the object dies during the call.
Diffstat (limited to 'Objects/listobject.c')
| -rw-r--r-- | Objects/listobject.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/Objects/listobject.c b/Objects/listobject.c index 86690f764b..abe2604573 100644 --- a/Objects/listobject.c +++ b/Objects/listobject.c @@ -2662,8 +2662,15 @@ list_richcompare(PyObject *v, PyObject *w, int op) /* Search for the first index where items are different */ for (i = 0; i < Py_SIZE(vl) && i < Py_SIZE(wl); i++) { + PyObject *vitem = vl->ob_item[i]; + PyObject *witem = wl->ob_item[i]; + + Py_INCREF(vitem); + Py_INCREF(witem); int k = PyObject_RichCompareBool(vl->ob_item[i], wl->ob_item[i], Py_EQ); + Py_DECREF(vitem); + Py_DECREF(witem); if (k < 0) return NULL; if (!k) |