[Python-checkins] cpython (3.2): Issue #16228: Fix a crash in the json module where a list changes size while it

[antoine.pitrou]

http://hg.python.org/cpython/rev/3672db224eb3
changeset:   80157:3672db224eb3
branch:      3.2
parent:      80152:e95e647040de
user:        Antoine Pitrou <solipsis at pitrou.net>
date:        Thu Nov 01 19:52:06 2012 +0100
summary:
  Issue #16228: Fix a crash in the json module where a list changes size while it is being encoded.
Patch by Serhiy Storchaka.

files:
  Lib/test/json_tests/test_dump.py |   8 ++++++++
  Misc/NEWS                        |   3 +++
  Modules/_json.c                  |  10 +++-------
  3 files changed, 14 insertions(+), 7 deletions(-)


diff --git a/Lib/test/json_tests/test_dump.py b/Lib/test/json_tests/test_dump.py
--- a/Lib/test/json_tests/test_dump.py
+++ b/Lib/test/json_tests/test_dump.py
@@ -19,6 +19,14 @@
                 {2: 3.0, 4.0: 5, False: 1, 6: True}, sort_keys=True),
                 '{"false": 1, "2": 3.0, "4.0": 5, "6": true}')
 
+    # Issue 16228: Crash on encoding resized list
+    def test_encode_mutated(self):
+        a = [object()] * 10
+        def crasher(obj):
+            del a[-1]
+        self.assertEqual(self.dumps(a, default=crasher),
+                 '[null, null, null, null, null]')
+
 
 class TestPyDump(TestDump, PyTest): pass
 class TestCDump(TestDump, CTest): pass
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -143,6 +143,9 @@
 Library
 -------
 
+- Issue #16228: Fix a crash in the json module where a list changes size
+  while it is being encoded.  Patch by Serhiy Storchaka.
+
 - Issue #14897: Enhance error messages of struct.pack and
   struct.pack_into. Patch by Matti Mäki.
 
diff --git a/Modules/_json.c b/Modules/_json.c
--- a/Modules/_json.c
+++ b/Modules/_json.c
@@ -1585,8 +1585,6 @@
     static PyObject *empty_array = NULL;
     PyObject *ident = NULL;
     PyObject *s_fast = NULL;
-    Py_ssize_t num_items;
-    PyObject **seq_items;
     Py_ssize_t i;
 
     if (open_array == NULL || close_array == NULL || empty_array == NULL) {
@@ -1600,8 +1598,7 @@
     s_fast = PySequence_Fast(seq, "_iterencode_list needs a sequence");
     if (s_fast == NULL)
         return -1;
-    num_items = PySequence_Fast_GET_SIZE(s_fast);
-    if (num_items == 0) {
+    if (PySequence_Fast_GET_SIZE(s_fast) == 0) {
         Py_DECREF(s_fast);
         return PyList_Append(rval, empty_array);
     }
@@ -1622,7 +1619,6 @@
         }
     }
 
-    seq_items = PySequence_Fast_ITEMS(s_fast);
     if (PyList_Append(rval, open_array))
         goto bail;
     if (s->indent != Py_None) {
@@ -1634,8 +1630,8 @@
             buf += newline_indent
         */
     }
-    for (i = 0; i < num_items; i++) {
-        PyObject *obj = seq_items[i];
+    for (i = 0; i < PySequence_Fast_GET_SIZE(s_fast); i++) {
+        PyObject *obj = PySequence_Fast_GET_ITEM(s_fast, i);
         if (i) {
             if (PyList_Append(rval, s->item_separator))
                 goto bail;

-- 
Repository URL: http://hg.python.org/cpython