diff options
author | Éric Araujo <merwok@netwok.org> | 2011-03-22 23:47:32 +0100 |
---|---|---|
committer | Éric Araujo <merwok@netwok.org> | 2011-03-22 23:47:32 +0100 |
commit | f66362eed0024d2f233eb24ba10d6f217c50461c (patch) | |
tree | 1ecd2a87890333c9dd2399295d7fc75745fd35b7 /Objects/setobject.c | |
parent | 7bb633f6fbaa820d40cd93a1c867200218568380 (diff) | |
download | cpython-f66362eed0024d2f233eb24ba10d6f217c50461c.tar.gz |
Fix obscure set crashers (#4420). Backport of d56b3cafb1e6, reviewed by Raymond.
Diffstat (limited to 'Objects/setobject.c')
-rw-r--r-- | Objects/setobject.c | 33 |
1 files changed, 23 insertions, 10 deletions
diff --git a/Objects/setobject.c b/Objects/setobject.c index 00cabe609d..802f45f4c4 100644 --- a/Objects/setobject.c +++ b/Objects/setobject.c @@ -362,12 +362,14 @@ static int set_add_entry(register PySetObject *so, setentry *entry) { register Py_ssize_t n_used; + PyObject *key = entry->key; + long hash = entry->hash; assert(so->fill <= so->mask); /* at least one empty slot */ n_used = so->used; - Py_INCREF(entry->key); - if (set_insert_key(so, entry->key, entry->hash) == -1) { - Py_DECREF(entry->key); + Py_INCREF(key); + if (set_insert_key(so, key, hash) == -1) { + Py_DECREF(key); return -1; } if (!(so->used > n_used && so->fill*3 >= (so->mask+1)*2)) @@ -647,6 +649,8 @@ static int set_merge(PySetObject *so, PyObject *otherset) { PySetObject *other; + PyObject *key; + long hash; register Py_ssize_t i; register setentry *entry; @@ -667,11 +671,13 @@ set_merge(PySetObject *so, PyObject *otherset) } for (i = 0; i <= other->mask; i++) { entry = &other->table[i]; - if (entry->key != NULL && - entry->key != dummy) { - Py_INCREF(entry->key); - if (set_insert_key(so, entry->key, entry->hash) == -1) { - Py_DECREF(entry->key); + key = entry->key; + hash = entry->hash; + if (key != NULL && + key != dummy) { + Py_INCREF(key); + if (set_insert_key(so, key, hash) == -1) { + Py_DECREF(key); return -1; } } @@ -1640,15 +1646,22 @@ set_symmetric_difference_update(PySetObject *so, PyObject *other) while (_PyDict_Next(other, &pos, &key, &value, &hash)) { setentry an_entry; + Py_INCREF(key); an_entry.hash = hash; an_entry.key = key; + rv = set_discard_entry(so, &an_entry); - if (rv == -1) + if (rv == -1) { + Py_DECREF(key); return NULL; + } if (rv == DISCARD_NOTFOUND) { - if (set_add_entry(so, &an_entry) == -1) + if (set_add_entry(so, &an_entry) == -1) { + Py_DECREF(key); return NULL; + } } + Py_DECREF(key); } Py_RETURN_NONE; } |