[issue25716] typeobject.c call_method & call_maybe can leak references on 'func'

[Irit Katriel]

Change by Irit Katriel :


--
stage: patch review -> resolved
status: pending -> closed

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue25716] typeobject.c call_method & call_maybe can leak references on 'func'

[Irit Katriel]

Irit Katriel  added the comment:

I believe this issue is out of date. There are no longer such functions as 
call_method and call_maybe. There are vectorcall_method and vectorcall_maybe, 
but they don't have that check for (args == NULL).

--
nosy: +iritkatriel
resolution:  -> out of date
status: open -> pending

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue25716] typeobject.c call_method & call_maybe can leak references on 'func'

[Myron Walker]

Myron Walker added the comment:

Found this with code inspection

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue25716] typeobject.c call_method & call_maybe can leak references on 'func'

[Myron Walker]

Myron Walker added the comment:

I think this usage of 'call_method' from typeobject.c would cause it to leak.

static PyObject*
slot_sq_slice(PyObject *self, Py_ssize_t i, Py_ssize_t j)
{
static PyObject *getslice_str;

if (PyErr_WarnPy3k("in 3.x, __getslice__ has been removed; "
"use __getitem__", 1) < 0)
return NULL;
return call_method(self, "__getslice__", _str,
"nn", i, j);  <<< Maybe Bad Format Str <<<
}

Looks like the only place in 'call_method' that could cause args to be NULL is 
if 'Py_VaBuildValue' which calls 'va_build_value' returns NULL.  
'va_build_value' calls 'countformat' on the format string and 'countformat' 
looks for some escaping in the format string.  If no special format characters 
like '(' or '{' are not found, then the count might be incremented but when the 
NULL terminator on the end of the string is hit, the 'countformat' will return 
-1.

So I believe this method has a bug because it doesn't look to be using the 
formatter correctly and also it looks like it might cause a leak.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue25716] typeobject.c call_method & call_maybe can leak references on 'func'

[Myron Walker]

Myron Walker added the comment:

I'll file a seperate bug on 'countformat'

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue25716] typeobject.c call_method & call_maybe can leak references on 'func'

[Emanuel Barry]

Emanuel Barry added the comment:

Could you provide actual code where a reference is leaked? To me, this looks 
like hypothetical failure rather than something that has a chance of occurring 
- feel free to prove me wrong, though :) Please also include relevant tests.

--
nosy: +ebarry

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue25716] typeobject.c call_method & call_maybe can leak references on 'func'

[Myron Walker]

New submission from Myron Walker:

The 'call_method' and 'call_maybe' function in typeobject.c are leaking
a reference on 'func' in cases where 'args == NULL'.  In this case both 
of these functions exit like so:

if (args == NULL)
return NULL;

When they need to do:

if (args == NULL)
{
Py_DECREF(func);
return NULL;
}

--
components: Interpreter Core
messages: 255235
nosy: Myron Walker
priority: normal
severity: normal
status: open
title: typeobject.c call_method & call_maybe can leak references on 'func'
type: resource usage
versions: Python 2.7

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue25716] typeobject.c call_method & call_maybe can leak references on 'func'

[Myron Walker]

Changes by Myron Walker :


--
versions: +Python 3.2, Python 3.3, Python 3.4, Python 3.5, Python 3.6

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue25716] typeobject.c call_method & call_maybe can leak references on 'func'

[Martin Panter]

Martin Panter added the comment:

Thanks, here is a patch with the proposed fix. I also removed an unused macro.

Do you have an easy way to verify this, e.g. by calling a method from Python 
with invalid arguments? Or is this just something you found by inspection?

--
keywords: +patch
nosy: +martin.panter
stage:  -> patch review
versions:  -Python 3.2, Python 3.3
Added file: http://bugs.python.org/file41144/call-leak.patch

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com