New submission from Dave Malcolm <dmalc...@redhat.com>:
$ mkdir some_directory_ending_with_a.py
$ python -c "import imputil;
imputil.imp.find_module('some_directory_ending_with_a')"
*** glibc detected *** python: double free or corruption (!prev):
0x0000000001589bf0 ***
Aborted
What's happening is that call_find_module opens fp, and tries to create a
PyFileObject from it:
2844 if (fp != NULL) {
>>2845 fob = PyFile_FromFile(fp, pathname, fdp->mode, fclose);
2846 if (fob == NULL) {
2847 fclose(fp);
2848 return NULL;
2849 }
2850 }
The call fails at the very end of fill_file_fields() inside the call to
dircheck() here:
180 f->f_fp = fp;
181 f = dircheck(f);
182 return (PyObject *) f;
183 }
184
but f->fp == fp
Hence when fill_file_fields returns NULL, and f is cleaned up here:
484 if (fill_file_fields(f, fp, o_name, mode, close) == NULL) {
>> 485 Py_DECREF(f);
486 Py_DECREF(o_name);
487 return NULL;
488 }
then f->fp is closed within file_dealloc()
Then, when PyFile_FromFile returns NULL, call_find_module calls fclose(fp):
2844 if (fp != NULL) {
2845 fob = PyFile_FromFile(fp, pathname, fdp->mode, fclose);
2846 if (fob == NULL) {
>>2847 fclose(fp);
2848 return NULL;
2849 }
2850 }
and it attempts to close fp for the second time.
The documentation for PyFile_FromFile:
http://docs.python.org/c-api/file.html#PyFile_FromFile
says:
"Return NULL and close the file using close on failure".
It therefore looks like call_find_module's fclose(fp) is incorrect here, and is
what leads to the double-free.
----------
components: Library (Lib)
messages: 153799
nosy: dmalcolm
priority: normal
severity: normal
status: open
title: Crash in imputil.imp.find_module when a *directory* exists with the
given name due to double-close of FILE*
type: crash
versions: Python 2.7
_______________________________________
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue14066>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe:
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
