[issue11826] Leak in atexitmodule

Stefan Krah report at bugs.python.org
Mon Mar 26 17:02:12 CEST 2012


Stefan Krah <stefan-usenet at bytereef.org> added the comment:

Actually _iomodule.c already has a freefunc with the same signature.
atexit_free() is properly called in:

static void
module_dealloc(PyModuleObject *m)
{
    PyObject_GC_UnTrack(m);
    if (m->md_def && m->md_def->m_free)
        m->md_def->m_free(m);
    if (m->md_dict != NULL) {
        _PyModule_Clear((PyObject *)m);
        Py_DECREF(m->md_dict);
    }
    if (m->md_state != NULL)
        PyMem_FREE(m->md_state);
    Py_TYPE(m)->tp_free((PyObject *)m);
}


So my only worry is if there's a way to exploit the fact that _PyModule_Clear()
is called after atexit_free(). I tried things like: 

>>> import atexit
>>> def g(): pass
...
>>> class silly:
...     def __del__(self): atexit.register(g)
...
>>> atexit.x = silly()
>>> atexit.register(g)
<function g at 0x7fe7ebb83a68>
>>>
Exception AttributeError: "'NoneType' object has no attribute 'register'" in <bound method silly.__del__ of <__main__.silly object at 0x153fc50>> ignored


But I haven't been able to break anything, so I think I'll go ahead and
commit if there aren't any protests.

----------

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue11826>
_______________________________________


More information about the Python-bugs-list mailing list