Benjamin Peterson benja...@python.org added the comment:
Fixed in r71860.
--
resolution: accepted - fixed
status: open - closed
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue5283
___
Gregory P. Smith g...@krypto.org added the comment:
Could the PyObject_ClearWeakRefs(self); call in the middle of the lines
del_changes_class.patch adds also be used to cause python code to set
__del__ or __dict__ causing the wrong destructor or wrong dict to be
DECREFed?
(I'm trying to wrap
Amaury Forgeot d'Arc amaur...@gmail.com added the comment:
I carefully looked at all places that store -ob_type or Py_TYPE() in a
local variable, and I could not find any exploit. Most places don't
reuse the type once the method or the slot has been called.
Two places were harder to analyze:
Benjamin Peterson benja...@python.org added the comment:
On Wed, Feb 18, 2009 at 4:51 PM, Amaury Forgeot d'Arc
rep...@bugs.python.org wrote:
Amaury Forgeot d'Arc amaur...@gmail.com added the comment:
I carefully looked at all places that store -ob_type or Py_TYPE() in a
local variable, and
Changes by Amaury Forgeot d'Arc amaur...@gmail.com:
--
assignee: - amaury.forgeotdarc
keywords: -needs review
resolution: - accepted
stage: - commit review
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue5283
Amaury Forgeot d'Arc amaur...@gmail.com added the comment:
Yes, the wrong type is DECREF'd when the object is deallocated.
Patch attached.
--
keywords: +needs review, patch
nosy: +amaury.forgeotdarc
Added file: http://bugs.python.org/file13123/del_changes_class.patch
