[ python-Bugs-1314182 ] crash in longobject (invalid memory access)

SourceForge.net noreply at sourceforge.net
Wed Oct 5 22:03:18 CEST 2005


Bugs item #1314182, was opened at 2005-10-05 15:03
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=1314182&group_id=5470

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Python Interpreter Core
Group: None
Status: Open
Resolution: None
Priority: 5
Submitted By: Jon Nelson (jnelson)
Assigned to: Nobody/Anonymous (nobody)
Summary: crash in longobject (invalid memory access)

Initial Comment:
While debugging a memory consumption problem, I disable
pymalloc and found a crasher in longobject.c, line 2518
(Python 2.4.1).

The code currently reads:

    Py_XDECREF(a);
    Py_XDECREF(b);
    Py_XDECREF(c);
    Py_XDECREF(temp);
    if (b->ob_size > FIVEARY_CUTOFF) {
        for (i = 0; i < 32; ++i)
            Py_XDECREF(table[i]);
    }
    return (PyObject *)z;

It *should* read:

    Py_XDECREF(a);
    Py_XDECREF(c);
    Py_XDECREF(temp);
    if (b->ob_size > FIVEARY_CUTOFF) {
        for (i = 0; i < 32; ++i)
            Py_XDECREF(table[i]);
    }
    Py_XDECREF(b);
    return (PyObject *)z;

because without the change you clearly access "b"
*after* freeing it.



----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=1314182&group_id=5470


More information about the Python-bugs-list mailing list