[New-bugs-announce] [issue14372] Fix all invalid usage of borrowed references

[STINNER Victor]

New submission from STINNER Victor <victor.stinner at gmail.com>:

I fixed the issues #14211 and #14231. These issues were invalid usage of borrowed reference: the reference can be destroyed before the reference is used.

Armin Rigo replied:

"I will attempt a last time to mention that the docstrings in borrowed_ref_*.py used to say they were *examples*.

That means: (1) find any internal or external C function that returns a borrowed reference; (2) find all callers and write down all the places that don't immediately either Py_INCREF() the returned value or immediately forget about it; (3) for each such place, either come up painfully with a complicated explanation of why it's safe in all possible cases, or in doubt, just fix it by adding Py_INCREF()/Py_DECREF().

What I did in writing these two borrowed_ref_*.py was to do instead (3') spend a few hours figuring out how to exploit the issue until we get a segfault.  I did it for two examples, but what I'm definitely not going to do is spend N times a few hours for a large number N.  If python-dev people just fix the two examples, remove the crashers, and just forget about the issue, then well, the point is missed, but I'm not going to fight it."

Sorry Armin, I didn't know that the issue of borrowed was a generic issue and more code need to be fixed. So I'm opening this issue to track of invalid usage of borrowed references.

----------
components: Interpreter Core, Library (Lib)
messages: 156401
nosy: haypo
priority: normal
severity: normal
status: open
title: Fix all invalid usage of borrowed references
type: crash
versions: Python 3.3

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue14372>
_______________________________________