[New-bugs-announce] [issue31608] crash in methods of a subclass of _collections.deque with a bad __new__()

[Oren Milman]

New submission from Oren Milman <orenmn at gmail.com>:

The following code causes the interpreter to crash:

import _collections
class BadDeque(_collections.deque):
    def __new__(cls, *args):
        if len(args):
            return 42
        return _collections.deque.__new__(cls)

BadDeque() * 42

(The interpreter would crash also if we replaced 'BadDeque() * 42' with
'BadDeque() + _collections.deque([42])'.)

This is because deque_copy() (in Modules/_collectionsmodule.c) returns whatever
BadDeque() returned, without verifying it is a deque.
deque_repeat() assumes that deque_copy() returned a deque, and passes it to
deque_inplace_repeat(), which assumes it is a deque, and crashes.

(Similarly, deque_concat() assumes that deque_copy() returned a deque, which
is the reason for the other crash.)


ISTM it is a very unlikely corner case, so that adding a test (as well as
a NEWS.d item) for it is unnecessary.
What do you think?

----------
components: Extension Modules
messages: 303125
nosy: Oren Milman
priority: normal
severity: normal
status: open
title: crash in methods of a subclass of _collections.deque with a bad __new__()
type: crash
versions: Python 3.7

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue31608>
_______________________________________