-
-
Notifications
You must be signed in to change notification settings - Fork 32.4k
Closed
Closed
Copy link
Labels
3.10only security fixesonly security fixes3.11only security fixesonly security fixes3.12only security fixesonly security fixestype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
Description
CPython crashes if run on the following code:
class pro(property):
def __new__(typ, *args, **kwargs):
return "abcdef"
class A:
pass
p = property.__new__(pro)
p.__set_name__(A, 1)
np = p.getter(lambda self: 1)
The crash happens on the last line. The problem is the following code in property_copy
:
new = PyObject_CallFunctionObjArgs(type, get, set, del, doc, NULL);
Py_DECREF(type);
if (new == NULL)
return NULL;
Py_XSETREF(((propertyobject *) new)->prop_name, Py_XNewRef(pold->prop_name));
return new;
In the crashing code, new
is a string, so casting it to propertyobject
and writing to prop_name
is wrong.
This is synthetic code, I found the problem while porting some 3.10 features to PyPy and thinking about corner cases.
Linked PRs
Metadata
Metadata
Assignees
Labels
3.10only security fixesonly security fixes3.11only security fixesonly security fixes3.12only security fixesonly security fixestype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump