[New-bugs-announce] [issue14199] Keep a refence to mro in _PyType_Lookup() and super_getattro()

STINNER Victor report at bugs.python.org
Mon Mar 5 13:33:28 CET 2012

New submission from STINNER Victor <victor.stinner at gmail.com>:

Lib/test/crashers/losing_mro_ref.py does crash Python: _PyType_Lookup() borrows a reference to the type MRO, but the type MRO is replaced during the lookup. Python crashs because it reads an item from a tuple that was destroyed (in the specific test, it reads an item from a newly created tuple which is not the type MRO).

Attached patch keeps a strong reference to the type MRO during the lookup to workaround this crasher. It fixes Lib/test/crashers/losing_mro_ref.py.

If changing temporary has an impact on performances, a guard can be used to check that the type MRO has not been changed during the lookup.

components: Interpreter Core
files: type_lookup_mro.patch
keywords: patch
messages: 154943
nosy: haypo
priority: normal
severity: normal
status: open
title: Keep a refence to mro in _PyType_Lookup() and super_getattro()
type: crash
versions: Python 3.3
Added file: http://bugs.python.org/file24736/type_lookup_mro.patch

Python tracker <report at bugs.python.org>

More information about the New-bugs-announce mailing list