[Python-checkins] r66677 - in python/trunk: Lib/test/test_cprofile.py Misc/NEWS Modules/_lsprof.c

[brett.cannon]

Author: brett.cannon
Date: Mon Sep 29 05:41:21 2008
New Revision: 66677

Log:
The _lsprof module could crash the interpreter if it was given an external
timer that did not return a float and a timer was still running when the
Profiler object was garbage collected.

Fixes issue 3895.
Code review by Benjamin Peterson.


Modified:
   python/trunk/Lib/test/test_cprofile.py
   python/trunk/Misc/NEWS
   python/trunk/Modules/_lsprof.c

Modified: python/trunk/Lib/test/test_cprofile.py
==============================================================================
--- python/trunk/Lib/test/test_cprofile.py	(original)
+++ python/trunk/Lib/test/test_cprofile.py	Mon Sep 29 05:41:21 2008
@@ -1,7 +1,7 @@
 """Test suite for the cProfile module."""
 
 import sys
-from test.test_support import run_unittest
+from test.test_support import run_unittest, TESTFN, unlink
 
 # rip off all interesting stuff from test_profile
 import cProfile
@@ -10,6 +10,20 @@
 class CProfileTest(ProfileTest):
     profilerclass = cProfile.Profile
 
+    # Issue 3895.
+    def test_bad_counter_during_dealloc(self):
+        import _lsprof
+        # Must use a file as StringIO doesn't trigger the bug.
+        sys.stderr = open(TESTFN, 'w')
+        try:
+            obj = _lsprof.Profiler(lambda: int)
+            obj.enable()
+            obj = _lsprof.Profiler(1)
+            obj.disable()
+        finally:
+            sys.stderr = sys.__stderr__
+            unlink(TESTFN)
+
 
 def test_main():
     run_unittest(CProfileTest)

Modified: python/trunk/Misc/NEWS
==============================================================================
--- python/trunk/Misc/NEWS	(original)
+++ python/trunk/Misc/NEWS	Mon Sep 29 05:41:21 2008
@@ -23,6 +23,10 @@
 Library
 -------
 
+- Issue #3895: It was possible to crash the interpreter when an external timer
+  was used with cProfile that returned an object that could not be converted
+  into a float.
+
 - Issue #3950: Made turtle respect scale factors.
 
 - Issue #3547: Fixed ctypes structures bitfields of varying integer

Modified: python/trunk/Modules/_lsprof.c
==============================================================================
--- python/trunk/Modules/_lsprof.c	(original)
+++ python/trunk/Modules/_lsprof.c	Mon Sep 29 05:41:21 2008
@@ -150,7 +150,16 @@
 	}
 	Py_DECREF(o);
 	if (PyErr_Occurred()) {
-		PyErr_WriteUnraisable((PyObject *) pObj);
+		PyObject *context = (PyObject *)pObj;
+		/* May have been called by profiler_dealloc(). */
+		if (Py_REFCNT(context) < 1) {
+			context = PyString_FromString("profiler calling an "
+							"external timer");
+			if (context == NULL) {
+				return 0;
+			}
+		}
+		PyErr_WriteUnraisable(context);
 		return 0;
 	}
 	return result;