[issue22044] Premature Py_DECREF while generating a TypeError in call_tzinfo_method

2014-07-22 Thread Tom Flanagan 

New submission from Tom Flanagan:

call_tzinfo_method in Modules/_datetimemodule.c:900 calls Py_DECREF(offset)
before trying to use offset to generate a TypeError message.

This causes a crash if that was the last reference to offset and Py_DECREF 
clears it.

--
components: Library (Lib)
files: python_bug.diff
keywords: patch
messages: 223722
nosy: Knio, belopolsky
priority: normal
severity: normal
status: open
title: Premature Py_DECREF while generating a TypeError in call_tzinfo_method
type: crash
versions: Python 3.3, Python 3.4, Python 3.5
Added file: http://bugs.python.org/file36042/python_bug.diff

___
Python tracker 
<http://bugs.python.org/issue22044>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue22044] Premature Py_DECREF while generating a TypeError in call_tzinfo_method

2014-07-22 Thread Tom Flanagan 

Tom Flanagan added the comment:

Included python test case which causes a segmentation fault on

Python 3.4.1 (v3.4.1:c0e311e010fc, May 18 2014, 10:45:13) [MSC v.1600 64 bit 
(AMD64)] on win32

Python 3.4.0 (default, Apr 11 2014, 13:05:11) [GCC 4.8.2] on linux

Python 3.5.0a0 (default:89665cc05592+, Jul 22 2014, 21:35:55) [GCC 4.8.2] on 
linux

--
Added file: http://bugs.python.org/file36043/python_crash.py

___
Python tracker 
<http://bugs.python.org/issue22044>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue22668] memoryview.format is corrupted due to dangling shared pointer

2014-10-18 Thread Tom Flanagan 

New submission from Tom Flanagan:

When slicing or cloning a memoryview object that has been previously cast to 
change its format string, the new memoryview's format shares a pointer to the 
parent's format string, which may be deleted at any time.

This manifests as a corrupt format when using the new memoryview object, 
causing crashes or unexpected behavior.

Tested on:
Python 3.4.0 (default, Apr 11 2014, 13:05:11) [GCC 4.8.2] on linux
Python 3.4.1 (v3.4.1:c0e311e010fc, May 18 2014, 10:45:13) [MSC v.1600 64 bit 
(AMD64)] on win32
Python 3.5.0a0 (default:cb8606fc84df, Oct 18 2014, 14:55:44) [GCC 4.8.2] on 
linux

--
components: Interpreter Core
files: memoryview_bug.py
messages: 229664
nosy: Knio, pitrou, skrah
priority: normal
severity: normal
status: open
title: memoryview.format is corrupted due to dangling shared pointer
type: crash
versions: Python 3.4, Python 3.5, Python 3.6
Added file: http://bugs.python.org/file36965/memoryview_bug.py

___
Python tracker 
<http://bugs.python.org/issue22668>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue22668] memoryview.format is corrupted due to dangling shared pointer

2014-10-18 Thread Tom Flanagan 

Tom Flanagan added the comment:

Fix memoryview object allocations to copy format string

--
keywords: +patch
Added file: http://bugs.python.org/file36966/22668patch.diff

___
Python tracker 
<http://bugs.python.org/issue22668>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com