[Python-bugs-list] [ python-Bugs-492403 ] exec() segfaults on closure's func_code

[noreply@sourceforge.net]

Bugs item #492403, was opened at 2001-12-13 01:33
You can respond by visiting: 
http://sourceforge.net/tracker/?func=detail&atid=105470&aid=492403&group_id=5470

Category: Python Interpreter Core
Group: Python 2.1.1
Status: Open
Resolution: None
>Priority: 7
Submitted By: Danny Yoo (dyoo)
>Assigned to: Jeremy Hylton (jhylton)
Summary: exec() segfaults on closure's func_code

Initial Comment:
I was experimenting with func_code, and the
documentation in:

http://python.org/doc/current/lib/bltin-code-objects.html

made me curious to see what would happen if I tried to
exec() a closure's func_code.  This produces a segfault
under Python 2.1, 2.11, and 2.2b:

###
>>> from __future__ import nested_scopes
>>> def t1(n):
...     def t2(): return n
...     return t2
... 
>>> f = t1(5)
>>> f.func_code
<code object t2 at 0x810e5e0, file "<stdin>", line 2>
>>> exec(f.func_code)
Segmentation fault
###

This code also crashes if run as a program, so it's not
just in the interactive interpreter.  I've included a
"crash.py" file that reproduces the bug.


----------------------------------------------------------------------

>Comment By: Michael Hudson (mwh)
Date: 2001-12-13 02:29

Message:
Logged In: YES 
user_id=6656

This is very similar to another bug:

[ #443866 ] Evaluating func_code causing core dump
It's a bit embarrassing that this didn't get fixed when that
one did, but here's a fix.

Maybe the check for free variables should be in
PyEval_EvalCode()?  But then it's harder to give sensible
error messages.

----------------------------------------------------------------------

Comment By: Danny Yoo (dyoo)
Date: 2001-12-13 01:55

Message:
Logged In: YES 
user_id=49843

Ok, I'm investigating this a little more.  The segfault is
coming from ceval.c in the Python 2.1 source, line 628:

###
>>> exec(f.func_code)

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (LWP 6752)]
eval_code2 (co=0x810e5f8, globals=0x80cc2fc,
locals=0x80cc2fc, args=0x0, 
    argcount=0, kws=0x0, kwcount=0, defs=0x0, defcount=0,
closure=0x0)
    at Python/ceval.c:628
628
Python/ceval.c: No such file or directory.
	in Python/ceval.c
(gdb) p f->f_nfreevars
$1 = 1
(gdb) p closure
$2 = (PyObject *) 0x0
###


Line 628 contains the following:

    PyObject *o = PyTuple_GET_ITEM(closure, i);



Here's a backtrace after the segfault:

###
(gdb) bt
#0  eval_code2 (co=0x810e5f8, globals=0x80cc2fc,
locals=0x80cc2fc, args=0x0, 
    argcount=0, kws=0x0, kwcount=0, defs=0x0, defcount=0,
closure=0x0)
    at Python/ceval.c:628
#1  0x08054cc9 in PyEval_EvalCode (co=0x810e5f8,
globals=0x80cc2fc, 
    locals=0x80cc2fc) at Python/ceval.c:341
#2  0x08059c34 in exec_statement (f=0x80d3bc8, prog=0x810e5f8, 
    globals=0x80b952c, locals=0x80cc2fc) at Python/ceval.c:3497
#3  0x08056890 in eval_code2 (co=0x810cd18, globals=0x80cc2fc, 
    locals=0x80cc2fc, args=0x0, argcount=0, kws=0x0,
kwcount=0, defs=0x0, 
    defcount=0, closure=0x0) at Python/ceval.c:1457
#4  0x08054cc9 in PyEval_EvalCode (co=0x810cd18,
globals=0x80cc2fc, 
    locals=0x80cc2fc) at Python/ceval.c:341
#5  0x0806c483 in run_node (n=0x80d82f0, filename=0x809ec2d
"<stdin>", 
    globals=0x80cc2fc, locals=0x80cc2fc, flags=0xbffff958)
    at Python/pythonrun.c:1045
#6  0x0806b66e in PyRun_InteractiveOneFlags (fp=0x4017b3a0, 
    filename=0x809ec2d "<stdin>", flags=0xbffff958) at
Python/pythonrun.c:570
#7  0x0806b4c5 in PyRun_InteractiveLoopFlags (fp=0x4017b3a0, 
    filename=0x809ec2d "<stdin>", flags=0xbffff958) at
Python/pythonrun.c:510
#8  0x0806b3bb in PyRun_AnyFileExFlags (fp=0x4017b3a0, 
    filename=0x809ec2d "<stdin>", closeit=0, flags=0xbffff958)
    at Python/pythonrun.c:473
#9  0x08051dc0 in Py_Main (argc=1, argv=0xbffff9e4) at
Modules/main.c:320
#10 0x08051888 in main (argc=1, argv=0xbffff9e4) at
Modules/python.c:10
#11 0x4007e65f in __libc_start_main () from /lib/libc.so.6
###


I hope this makes sense to someone... *grin*

----------------------------------------------------------------------

You can respond by visiting: 
http://sourceforge.net/tracker/?func=detail&atid=105470&aid=492403&group_id=5470