[issue8420] Objects/setobject.c contains unsafe code

Éric Araujo added the comment: All done. -- stage: commit review -> committed/rejected status: open -> closed ___ Python tracker ___ _

[issue8420] Objects/setobject.c contains unsafe code

Roundup Robot added the comment: New changeset 57657393ceaf by Éric Araujo in branch '3.1': Fix obscure set crashers (#8420). Backport of d56b3cafb1e6, reviewed by Raymond. http://hg.python.org/cpython/rev/57657393ceaf -- nosy: +python-dev status: pending -> open

[issue8420] Objects/setobject.c contains unsafe code

Éric Araujo added the comment: Used wrong number in the commit message :/ Fixed in 24179f82b7de for 2.7. -- status: open -> pending ___ Python tracker ___ __

[issue8420] Objects/setobject.c contains unsafe code

Raymond Hettinger added the comment: Looks good. Can this be closed now? -- ___ Python tracker ___ ___ Python-bugs-list mailing list U

[issue8420] Objects/setobject.c contains unsafe code

Éric Araujo added the comment: Here is a part of my 3.1 patch: +PyObject *key = entry->key; +long hash = entry->hash; assert(so->fill <= so->mask); /* at least one empty slot */ n_used = so->used; -Py_INCREF(entry->key); -if (set_insert_key(so, entry->key, (long) ent

[issue8420] Objects/setobject.c contains unsafe code

Raymond Hettinger added the comment: Sure, go ahead and apply to 3.1 -- ___ Python tracker ___ ___ Python-bugs-list mailing list Unsub

[issue8420] Objects/setobject.c contains unsafe code

Éric Araujo added the comment: Is it a candidate for 3.1 too? -- ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue8420] Objects/setobject.c contains unsafe code

Raymond Hettinger added the comment: The revised patch looks good. Please make the same change for set_add_entry. If the tests run, go ahead and apply. -- ___ Python tracker ___

[issue8420] Objects/setobject.c contains unsafe code

Éric Araujo added the comment: BTW, set_add_entry still uses entry->hash. -- ___ Python tracker ___ ___ Python-bugs-list mailing list

[issue8420] Objects/setobject.c contains unsafe code

Éric Araujo added the comment: I assume you meant “hash = entry->hash”, not “entry->key”. Updated patch attached. -- Added file: http://bugs.python.org/file21341/fix-set-crashers-2.7.diff ___ Python tracker _

[issue8420] Objects/setobject.c contains unsafe code

Changes by Éric Araujo : Removed file: http://bugs.python.org/file21317/fix-set-crashers-2.7.diff ___ Python tracker ___ ___ Python-bugs-list m

[issue8420] Objects/setobject.c contains unsafe code

Raymond Hettinger added the comment: This looks okay. On the first lines for set_merge() where there is: key = entry->key; also do: hash = entry->key; so that the two get handled in a parallel fashion. Thanks for doing the backporting. -- assignee: rhettinger -> eric.araujo _

[issue8420] Objects/setobject.c contains unsafe code

Éric Araujo added the comment: I was able to reproduce the crash in 2.7 and fix it with the patch. I only had to remove a cast to long to make the patch apply. I also changed tabs to spaces in two lines. Please review and assign back to me for commit. :) -- assignee: eric.araujo ->

[issue8420] Objects/setobject.c contains unsafe code

Changes by Éric Araujo : -- status: closed -> open ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.p

[issue8420] Objects/setobject.c contains unsafe code

Éric Araujo added the comment: I’m doing the backport, I’ll assign back to Raymond when the patch is ready. -- assignee: rhettinger -> eric.araujo nosy: +eric.araujo versions: -Python 2.6 ___ Python tracker __

[issue8420] Objects/setobject.c contains unsafe code

Raymond Hettinger added the comment: Fixed in r84447 -- resolution: -> fixed status: open -> closed ___ Python tracker ___ ___ Python

[issue8420] Objects/setobject.c contains unsafe code

Changes by Eugene Kapun : Added file: http://bugs.python.org/file16981/repr.diff ___ Python tracker ___ ___ Python-bugs-list mailing list Unsub

[issue8420] Objects/setobject.c contains unsafe code

Raymond Hettinger added the comment: Patch please. -- ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: http://ma

[issue8420] Objects/setobject.c contains unsafe code

Eugene Kapun added the comment: This code crashes python by using another bug in set_repr. This only affects py3k. This code relies on out-of-memory condition, so run it like: $ (ulimit -v 65536 && python3 test.py) Otherwise, it will eat all your free memory before crashing. val = "a" * 1

[issue8420] Objects/setobject.c contains unsafe code

Raymond Hettinger added the comment: Fixed set_repr() issue in r80197 and r80196. Looks like someone futzed the unicode updates for 3.x. -- ___ Python tracker ___ _

[issue8420] Objects/setobject.c contains unsafe code

Eugene Kapun added the comment: > > One solution is to check that so->mask didn't > > change as well. > > I saw that and agree it would make a tighter check, but haven't convinced > myself that it is necessary. Without this check, it is possible that the comparison shrinks the table, so en

[issue8420] Objects/setobject.c contains unsafe code

Raymond Hettinger added the comment: >Bugs in set_repr: >> keys = PySequence_List((PyObject *)so); >> if (keys == NULL) >> goto done; >> >> listrepr = PyObject_Repr(keys); >> Py_DECREF(keys); >List pointed to by keys is already deallocated at this point. >> if (listrepr == NULL) { >>

[issue8420] Objects/setobject.c contains unsafe code

Raymond Hettinger added the comment: > One solution is to check that so->mask didn't > change as well. I saw that and agree it would make a tighter check, but haven't convinced myself that it is necessary. > Also, checking that refcnt > 1 is redundant > because if entry->key == startkey th

[issue8420] Objects/setobject.c contains unsafe code

Eugene Kapun added the comment: This patch still assumes that if so->table didn't change then the table wasn't reallocated (see http://en.wikipedia.org/wiki/ABA_problem). One solution is to check that so->mask didn't change as well. Also, checking that refcnt > 1 is redundant because if entry

[issue8420] Objects/setobject.c contains unsafe code

Raymond Hettinger added the comment: Attaching a patch for set_lookkey() that does a DECREF only when the refcnt > 1 so that the DECREF won't trigger any state changes. The merge crasher still needs a patch. -- keywords: +patch priority: -> normal stage: -> needs patch versions: +Py

[issue8420] Objects/setobject.c contains unsafe code

Changes by Eugene Kapun : -- type: -> crash ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.

[issue8420] Objects/setobject.c contains unsafe code

Eugene Kapun added the comment: I've found more unsafe code in Objects/setobject.c. This code makes Python 3.1.2 segfault by using a bug in function set_merge: class bad: def __eq__(self, other): if be_bad: set2.clear() rai