[Python-bugs-list] [ python-Bugs-624982 ] Potential AV in slot_sq_item

[noreply@sourceforge.net]

Bugs item #624982, was opened at 2002-10-17 16:22
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=624982&group_id=5470

Category: Python Interpreter Core
Group: Python 2.2.2
Status: Open
Resolution: None
Priority: 5
Submitted By: Greg Chapman (glchapman)
Assigned to: Nobody/Anonymous (nobody)
Summary: Potential AV in slot_sq_item

Initial Comment:
In slot_sq_item (in typeobject.c), if the 'func' returned from 
_Py_TypeLookup has a tp_descr_get method, this method 
is called and the result is stored in the func variable.  
However, this func value is never checked for NULL before 
being passed to PyObject_Call.  Thus, if the tp_descr_get 
tries to raise a Python exception (by returning NULL), an 
access violation occurs when PyObject_Call dereferences 
the NULL func pointer.  It appears from inspection of the 
latest version of typeobject.c (in CVS) that this bug is also 
present in Python 2.3.

I actually ran into this with an extension type, but here's 
some very contrived Python code which will cause the AV:

>>> class test(object):
...     __getitem__ = property(lambda s: 1/0)
...
>>> t = test()
>>> for i in t:
...     print i


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=624982&group_id=5470