Issue #3139: Make buffer-interface thread-safe wrt. PyArg_ParseTuple,

by denying s# to parse objects that have a releasebuffer procedure,
and introducing s*.

More module might need to get converted to use s*.

1 files changed, 16 insertions, 6 deletions

diff --git a/Modules/_multiprocessing/connection.h b/Modules/_multiprocessing/connection.h
index 4b475c6bf7..66a3e8ad86 100644
--- a/Modules/_multiprocessing/connection.h
+++ b/Modules/_multiprocessing/connection.h
@@ -187,21 +187,25 @@ connection_recvbytes_into(ConnectionObject *self, PyObject *args)
 	char *freeme = NULL, *buffer = NULL;
 	Py_ssize_t res, length, offset = 0;
 	PyObject *result = NULL;
+	Py_buffer pbuf;
 
-	if (!PyArg_ParseTuple(args, "w#|" F_PY_SSIZE_T, 
-			      &buffer, &length, &offset))
+	CHECK_READABLE(self);
+	
+	if (!PyArg_ParseTuple(args, "w*|" F_PY_SSIZE_T, 
+			      &pbuf, &offset))
 		return NULL;
 
-	CHECK_READABLE(self);
+	buffer = pbuf.buf;
+	length = pbuf.len;
 
 	if (offset < 0) {
 		PyErr_SetString(PyExc_ValueError, "negative offset");
-		return NULL;
+		goto _error;
 	}   
 
 	if (offset > length) {
 		PyErr_SetString(PyExc_ValueError, "offset too large");
-		return NULL;
+		goto _error;
 	}
 
 	res = conn_recv_string(self, buffer+offset, length-offset, 
@@ -231,11 +235,17 @@ connection_recvbytes_into(ConnectionObject *self, PyObject *args)
 				PyErr_SetObject(BufferTooShort, result);
 				Py_DECREF(result);
 			}
-			return NULL;
+			goto _error;
 		}
 	}
 
+_cleanup:
+	PyBuffer_Release(&pbuf);
 	return result;
+
+_error:
+	result = NULL;
+	goto _cleanup;
 }
 
 /*