Serhiy Storchaka added the comment:

Thank you for your report Artem.

But Modules/clinic/_struct.c.h is generated file, it shouldn't be manually 
edited. And clearing the cache doesn't solves the bug.

If _PyArg_ParseStack() failed it calls cache_struct_converter() for clearing 
s_object and jumps to the end of the function where s_object is decrefed second 
time. Yet one reference is left in the cache, but this is a hanging reference 
to deallocated object. Next call of struct.unpack() can retrieve that hanging 
reference and use it.

PR 1213 properly fixes this issue. It also fixes similar bug 
PyUnicode_FSDecoder(), but the latter is hardly reproducible since in the 
stdlib PyUnicode_FSDecoder() is used mostly for the last argument of a function.

----------

_______________________________________
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue29802>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

Reply via email to