[Patches] [ python-Patches-413552 ] Premature decref on object

noreply@sourceforge.net noreply@sourceforge.net
Sat, 07 Apr 2001 13:36:04 -0700


Patches item #413552, was updated on 2001-04-03 15:44
You can respond by visiting: 
http://sourceforge.net/tracker/?func=detail&atid=305470&aid=413552&group_id=5470

Category: core (C code)
Group: None
>Status: Closed
Priority: 5
Submitted By: Jeffery D. Collins (tokeneater)
Assigned to: Tim Peters (tim_one)
Summary: Premature decref on object

Initial Comment:
This is a fairly subtle decref problem in
filterstring() that takes advantage of a side effect in
string_item. The value "item" returned from sq_item
(string_item) normally has at least two reference
counts, one from membership in the array characters[]
and another acquired by upon return from string_item()
(plus possibly others).  So, the current order of
decrefing item in filterstring() works without causing
a failure.  For some work we are doing in Pippy, we
have eliminated the character[] array in stringobject.c
to save space.  As a result, the reference count of the
returned object is one.  So, when "item" is decrefed
prematurely, the object is garbage collected and the
next use of it causes an error (on the Palm).  This
patch fixes the problem by delaying the decref of
"item" until it is no longer needed by filterstring().

This patch was successfully tested via "make test".

 

----------------------------------------------------------------------

>Comment By: Tim Peters (tim_one)
Date: 2001-04-07 13:36

Message:
Logged In: YES 
user_id=31435

Thanks, Jeffrey!  I applied the patch:
    Python/bltinmodule.c
    new revision: 2.197


----------------------------------------------------------------------

Comment By: Tim Peters (tim_one)
Date: 2001-04-07 13:16

Message:
Logged In: YES 
user_id=31435

Assigned to me.  I agree filterstring should not drop the 
refcount on item before it finishes using it, and doubt 
this code *intended* to rely on the cross-module accident 
that's letting it work now.

----------------------------------------------------------------------

You can respond by visiting: 
http://sourceforge.net/tracker/?func=detail&atid=305470&aid=413552&group_id=5470