[issue3299] invalid object destruction in re.finditer()

STINNER Victor report at bugs.python.org
Mon Jul 14 03:40:03 CEST 2008


STINNER Victor <haypo at users.sourceforge.net> added the comment:

Valgrind output for Python trunk compiled with pydebug option:
==29848== Invalid read of size 4
==29848==    at 0x809AF61: _Py_ForgetReference (object.c:2044)
==29848==    by 0x809AFCF: _Py_Dealloc (object.c:2065)
==29848==    by 0x80FE635: call_function (ceval.c:3653)
==29848==    by 0x80F9C83: PyEval_EvalFrameEx (ceval.c:2350)
==29848==    by 0x80FC2D1: PyEval_EvalCodeEx (ceval.c:2914)
==29848==    by 0x80FEAFE: fast_function (ceval.c:3747)
==29848==    by 0x80FE75F: call_function (ceval.c:3672)
==29848==    by 0x80F9C83: PyEval_EvalFrameEx (ceval.c:2350)
==29848==    by 0x80FC2D1: PyEval_EvalCodeEx (ceval.c:2914)
==29848==    by 0x80F1219: PyEval_EvalCode (ceval.c:495)
==29848==    by 0x812838E: run_mod (pythonrun.c:1330)
==29848==    by 0x8128324: PyRun_FileExFlags (pythonrun.c:1316)
==29848==  Address 0x4475680 is 8 bytes inside a block of size 896 free'd
==29848==    at 0x402237F: free (vg_replace_malloc.c:233)
==29848==    by 0x809C51D: PyObject_Free (obmalloc.c:1114)
==29848==    by 0x809C86E: _PyObject_DebugFree (obmalloc.c:1361)
==29848==    by 0x814ECBD: pattern_scanner (_sre.c:3371)
==29848==    by 0x814C245: pattern_finditer (_sre.c:2148)
==29848==    by 0x81708D6: PyCFunction_Call (methodobject.c:81)
==29848==    by 0x80FE5C9: call_function (ceval.c:3651)
==29848==    by 0x80F9C83: PyEval_EvalFrameEx (ceval.c:2350)
==29848==    by 0x80FC2D1: PyEval_EvalCodeEx (ceval.c:2914)
==29848==    by 0x80FEAFE: fast_function (ceval.c:3747)
==29848==    by 0x80FE75F: call_function (ceval.c:3672)
==29848==    by 0x80F9C83: PyEval_EvalFrameEx (ceval.c:2350)
Fatal Python error: UNREF invalid object

The error comes from invalid use of PyObject_DEL(): as said by
georg.brandl, "PyObject_NEW adds the
object to the global linked list of all objects, which PyObject_DEL
obviously doesn't undo". An invalid object will stay in the object list
until it is used and then Python crash.

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue3299>
_______________________________________


More information about the Python-bugs-list mailing list