python: 2.7.15 -> 2.7.16

This commit is contained in:
Frederik Rietdijk 2019-03-04 08:56:15 +01:00
parent bd5b8df4cd
commit 347680df96
3 changed files with 3 additions and 79 deletions

View file

@ -79,20 +79,6 @@ let
sha256 = "0l9rw6r5r90iybdkp3hhl2pf0h0s1izc68h5d3ywrm92pq32wz57";
})
# "`type_getattro()` calls `tp_descr_get(self, obj, type)` without actually owning a reference to "self".
# In very rare cases, this can cause a segmentation fault if "self" is deleted by the descriptor."
# https://github.com/python/cpython/pull/6118
(fetchpatch {
name = "type_getattro.patch";
url = "file://${./type_getattro.patch}";
sha256 = "11v9yx20hs3jmw0wggzvmw39qs4mxay4kb8iq2qjydwy9ya61nrd";
})
(fetchpatch {
name = "CVE-2018-1000802.patch";
url = "https://github.com/python/cpython/pull/8985.patch";
sha256 = "1c8nq2c9sjqa8ipl62hiandg6a7lzrwwfhi3ky6jd3pxgyalrh97";
})
] ++ optionals (x11Support && stdenv.isDarwin) [
./use-correct-tcl-tk-on-darwin.patch
] ++ optionals stdenv.isLinux [

View file

@ -1,62 +0,0 @@
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -3137,6 +3137,7 @@
PyTypeObject *metatype = Py_TYPE(type);
PyObject *meta_attribute, *attribute;
descrgetfunc meta_get;
+ PyObject* res;
if (!PyUnicode_Check(name)) {
PyErr_Format(PyExc_TypeError,
@@ -3158,6 +3159,7 @@
meta_attribute = _PyType_Lookup(metatype, name);
if (meta_attribute != NULL) {
+ Py_INCREF(meta_attribute);
meta_get = Py_TYPE(meta_attribute)->tp_descr_get;
if (meta_get != NULL && PyDescr_IsData(meta_attribute)) {
@@ -3165,10 +3167,11 @@
* writes. Assume the attribute is not overridden in
* type's tp_dict (and bases): call the descriptor now.
*/
- return meta_get(meta_attribute, (PyObject *)type,
- (PyObject *)metatype);
+ res = meta_get(meta_attribute, (PyObject *)type,
+ (PyObject *)metatype);
+ Py_DECREF(meta_attribute);
+ return res;
}
- Py_INCREF(meta_attribute);
}
/* No data descriptor found on metatype. Look in tp_dict of this
@@ -3176,6 +3179,7 @@
attribute = _PyType_Lookup(type, name);
if (attribute != NULL) {
/* Implement descriptor functionality, if any */
+ Py_INCREF(attribute);
descrgetfunc local_get = Py_TYPE(attribute)->tp_descr_get;
Py_XDECREF(meta_attribute);
@@ -3183,11 +3187,12 @@
if (local_get != NULL) {
/* NULL 2nd argument indicates the descriptor was
* found on the target object itself (or a base) */
- return local_get(attribute, (PyObject *)NULL,
- (PyObject *)type);
+ res = local_get(attribute, (PyObject *)NULL,
+ (PyObject *)type);
+ Py_DECREF(attribute);
+ return res;
}
- Py_INCREF(attribute);
return attribute;
}
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and Builtins/2018-03-14-21-42-17.bpo-25750.lxgkQz.rst
@@ -0,0 +1,2 @@
+Fix rare Python crash due to bad refcounting in ``type_getattro()`` if a
+descriptor deletes itself from the class.

View file

@ -50,10 +50,10 @@ in {
sourceVersion = {
major = "2";
minor = "7";
patch = "15";
patch = "16";
suffix = "";
};
sha256 = "0x2mvz9dp11wj7p5ccvmk9s0hzjk2fa1m462p395l4r6bfnb3n92";
sha256 = "1mqfcqp5y8r0bfyr7ppl74n0lig45p9mc4b8adlcpvj74rhfy8pj";
inherit (darwin) CF configd;
inherit passthruFun;
};
@ -153,4 +153,4 @@ in {
ncurses = ncurses5;
};
})
})