New submission from Eric Snow <ericsnowcurren...@gmail.com>: While perhaps esoteric, it looks like exec'ing a code object that has freevars, using a closure that has too few cells causes a segfault. I believe the problem is around line 3276 of ceval.c at the PyTuple_GET_ITEM call:
if (PyTuple_GET_SIZE(co->co_freevars)) { int i; for (i = 0; i < PyTuple_GET_SIZE(co->co_freevars); ++i) { >>> PyObject *o = PyTuple_GET_ITEM(closure, i); Py_INCREF(o); freevars[PyTuple_GET_SIZE(co->co_cellvars) + i] = o; } } I only bring this up because I am toying around with exposing a wrapper around PyEval_EvalCodeEx that is a more fully featured version of exec. Here is an example of code where I ran into the problem: def outer(): x = 5 y = 6 def f(): return x,y z = 7 def g(): return z exec_closure(f.__code__, closure=g.__closure__) Incidently, it looks there isn't any check to see if len(closure) > len(freevars), which I would expect to be disallowed. However, I understand that there hasn't really been any point to worry about it due to the current usage of PyEval_EvalCodeEx. If the above two constraints are appropriate I would love to see them added in with something like the following: if (closure == NULL) &closure = PyTuple_New(0); if (!PyTuple_Check(closure)) { PyErr_Format(PyExc_TypeError, "closure must be a tuple"); goto fail; } Py_ssize_t nfreevars = PyTuple_GET_SIZE(co->co_freevars); Py_ssize_t ncells = PyTuple_GET_SIZE(closure); if (nfreevars != ncells) { PyErr_Format(PyExc_SystemError, "Expected %s cells, received %s", nfreevars, ncells); goto fail; } if (nfreevars) { int i; for (i = 0; i < PyTuple_GET_SIZE(co->co_freevars); ++i) { PyObject *o = PyTuple_GET_ITEM(closure, i); Py_INCREF(o); freevars[PyTuple_GET_SIZE(co->co_cellvars) + i] = o; } } Alternately, I could just add some validation into exec_closure, if it's not worth bothering in ceval.c. ---------- components: Interpreter Core messages: 131961 nosy: ericsnow priority: normal severity: normal status: open title: closure with too few cells segfaults type: crash versions: Python 3.3 _______________________________________ Python tracker <rep...@bugs.python.org> <http://bugs.python.org/issue11660> _______________________________________ _______________________________________________ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com