New submission from Eric Snow <[email protected]>:
While perhaps esoteric, it looks like exec'ing a code object that has freevars,
using a closure that has too few cells causes a segfault. I believe the
problem is around line 3276 of ceval.c at the PyTuple_GET_ITEM call:
if (PyTuple_GET_SIZE(co->co_freevars)) {
int i;
for (i = 0; i < PyTuple_GET_SIZE(co->co_freevars); ++i) {
>>> PyObject *o = PyTuple_GET_ITEM(closure, i);
Py_INCREF(o);
freevars[PyTuple_GET_SIZE(co->co_cellvars) + i] = o;
}
}
I only bring this up because I am toying around with exposing a wrapper around
PyEval_EvalCodeEx that is a more fully featured version of exec. Here is an
example of code where I ran into the problem:
def outer():
x = 5
y = 6
def f(): return x,y
z = 7
def g(): return z
exec_closure(f.__code__, closure=g.__closure__)
Incidently, it looks there isn't any check to see if len(closure) >
len(freevars), which I would expect to be disallowed. However, I understand
that there hasn't really been any point to worry about it due to the current
usage of PyEval_EvalCodeEx.
If the above two constraints are appropriate I would love to see them added in
with something like the following:
if (closure == NULL)
&closure = PyTuple_New(0);
if (!PyTuple_Check(closure)) {
PyErr_Format(PyExc_TypeError,
"closure must be a tuple");
goto fail;
}
Py_ssize_t nfreevars = PyTuple_GET_SIZE(co->co_freevars);
Py_ssize_t ncells = PyTuple_GET_SIZE(closure);
if (nfreevars != ncells) {
PyErr_Format(PyExc_SystemError,
"Expected %s cells, received %s",
nfreevars, ncells);
goto fail;
}
if (nfreevars) {
int i;
for (i = 0; i < PyTuple_GET_SIZE(co->co_freevars); ++i) {
PyObject *o = PyTuple_GET_ITEM(closure, i);
Py_INCREF(o);
freevars[PyTuple_GET_SIZE(co->co_cellvars) + i] = o;
}
}
Alternately, I could just add some validation into exec_closure, if it's not
worth bothering in ceval.c.
----------
components: Interpreter Core
messages: 131961
nosy: ericsnow
priority: normal
severity: normal
status: open
title: closure with too few cells segfaults
type: crash
versions: Python 3.3
_______________________________________
Python tracker <[email protected]>
<http://bugs.python.org/issue11660>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe:
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
