From b9ced63613a6cc104e0de96f5ee90a47a049e815 Mon Sep 17 00:00:00 2001 From: Oren Milman Date: Tue, 11 Sep 2018 21:46:55 +0300 Subject: [2.7] closes bpo-31608: Fix a crash in methods of a subclass of _collections.deque with a bad __new__(). (GH-3788). (cherry picked from commit 24bd50bdcc97d65130c07d6cd26085fd06c3e972) Co-authored-by: Oren Milman --- Lib/test/test_deque.py | 15 +++++++++++++++ .../next/Library/2017-10-29-10-37-55.bpo-31608.wkp8Nw.rst | 2 ++ Modules/_collectionsmodule.c | 13 +++++++++++-- 3 files changed, 28 insertions(+), 2 deletions(-) create mode 100644 Misc/NEWS.d/next/Library/2017-10-29-10-37-55.bpo-31608.wkp8Nw.rst diff --git a/Lib/test/test_deque.py b/Lib/test/test_deque.py index c81064d9f2..b2819f6584 100644 --- a/Lib/test/test_deque.py +++ b/Lib/test/test_deque.py @@ -659,6 +659,21 @@ class TestSubclass(unittest.TestCase): d1 == d2 # not clear if this is supposed to be True or False, # but it used to give a SystemError + @support.cpython_only + def test_bug_31608(self): + # The interpreter used to crash in specific cases where a deque + # subclass returned a non-deque. + class X(deque): + pass + d = X() + def bad___new__(cls, *args, **kwargs): + return [42] + X.__new__ = bad___new__ + with self.assertRaises(TypeError): + d * 42 # shouldn't crash + with self.assertRaises(TypeError): + d + deque([1, 2, 3]) # shouldn't crash + class SubclassWithKwargs(deque): def __init__(self, newarg=1): diff --git a/Misc/NEWS.d/next/Library/2017-10-29-10-37-55.bpo-31608.wkp8Nw.rst b/Misc/NEWS.d/next/Library/2017-10-29-10-37-55.bpo-31608.wkp8Nw.rst new file mode 100644 index 0000000000..d657a86973 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2017-10-29-10-37-55.bpo-31608.wkp8Nw.rst @@ -0,0 +1,2 @@ +Raise a ``TypeError`` instead of crashing if a ``collections.deque`` subclass +returns a non-deque from ``__new__``. Patch by Oren Milman. diff --git a/Modules/_collectionsmodule.c b/Modules/_collectionsmodule.c index 9364aba549..3ca393082f 100644 --- a/Modules/_collectionsmodule.c +++ b/Modules/_collectionsmodule.c @@ -859,11 +859,20 @@ deque_traverse(dequeobject *deque, visitproc visit, void *arg) static PyObject * deque_copy(PyObject *deque) { + PyObject *result; if (((dequeobject *)deque)->maxlen == -1) - return PyObject_CallFunction((PyObject *)(Py_TYPE(deque)), "O", deque, NULL); + result = PyObject_CallFunction((PyObject *)(Py_TYPE(deque)), "O", deque, NULL); else - return PyObject_CallFunction((PyObject *)(Py_TYPE(deque)), "Oi", + result = PyObject_CallFunction((PyObject *)(Py_TYPE(deque)), "Oi", deque, ((dequeobject *)deque)->maxlen, NULL); + if (result != NULL && !PyObject_TypeCheck(result, &deque_type)) { + PyErr_Format(PyExc_TypeError, + "%.200s() must return a deque, not %.200s", + Py_TYPE(deque)->tp_name, Py_TYPE(result)->tp_name); + Py_DECREF(result); + return NULL; + } + return result; } PyDoc_STRVAR(copy_doc, "Return a shallow copy of a deque."); -- cgit v1.2.1