[ python-Bugs-1314182 ] crash in longobject (invalid memory access)

[SourceForge.net]

Bugs item #1314182, was opened at 2005-10-05 16:03
Message generated for change (Comment added) made by tim_one
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=1314182&group_id=5470

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Python Interpreter Core
Group: None
>Status: Closed
>Resolution: Duplicate
Priority: 5
Submitted By: Jon Nelson (jnelson)
Assigned to: Nobody/Anonymous (nobody)
Summary: crash in longobject (invalid memory access)

Initial Comment:
While debugging a memory consumption problem, I disable
pymalloc and found a crasher in longobject.c, line 2518
(Python 2.4.1).

The code currently reads:

    Py_XDECREF(a);
    Py_XDECREF(b);
    Py_XDECREF(c);
    Py_XDECREF(temp);
    if (b->ob_size > FIVEARY_CUTOFF) {
        for (i = 0; i < 32; ++i)
            Py_XDECREF(table[i]);
    }
    return (PyObject *)z;

It *should* read:

    Py_XDECREF(a);
    Py_XDECREF(c);
    Py_XDECREF(temp);
    if (b->ob_size > FIVEARY_CUTOFF) {
        for (i = 0; i < 32; ++i)
            Py_XDECREF(table[i]);
    }
    Py_XDECREF(b);
    return (PyObject *)z;

because without the change you clearly access "b"
*after* freeing it.



----------------------------------------------------------------------

>Comment By: Tim Peters (tim_one)
Date: 2005-10-05 16:54

Message:
Logged In: YES 
user_id=31435

This is a duplicate of bug 1238681 (& already fixed).

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=1314182&group_id=5470