[issue4176] segfault with pickle if 4th or 5th item of tuple returned by __reduce__ is not an iterator

[Hirokazu Yamamoto]

New submission from Hirokazu Yamamoto <ocean-city at m2.ccsnet.ne.jp>:

Following code crashes. (See issue4170)

trunk/Modules/cPickle.c (save() or save_reduce()) needs more checks of
returned value from __reduce__.

class C(object):
    def __reduce__(self):
        return C, (), None, None, [] # 5th item is not an iterator
class D(object):
    def __reduce__(self):
        return D, (), None, [], None # 4th item is not an iterator

import sys
if sys.version_info[0] == 3:
    import pickle
else:
    import cPickle as pickle
pickle.dumps(C()) # crash
pickle.dumps(D()) # crash

----------
components: Extension Modules
messages: 75094
nosy: ocean-city
severity: normal
status: open
title: segfault with pickle if 4th or 5th item of tuple returned by __reduce__ is not an iterator
type: crash
versions: Python 2.5, Python 2.6, Python 2.7, Python 3.0, Python 3.1

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue4176>
_______________________________________