[issue31728] crashes in _elementtree due to unsafe decrefs of Element.text and Element.tail

[Serhiy Storchaka]

Serhiy Storchaka  added the comment:

Thank you Oren!

--
resolution:  -> fixed
stage: patch review -> resolved
status: open -> closed

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31728] crashes in _elementtree due to unsafe decrefs of Element.text and Element.tail

[Serhiy Storchaka]

Serhiy Storchaka  added the comment:


New changeset f15058a697de12b0efe6c7ebc38fe61a993bb5d5 by Serhiy Storchaka 
(Oren Milman) in branch '2.7':
[2.7] bpo-31728: Prevent crashes in _elementtree due to unsafe cleanup of 
Element.text and Element.tail (GH-3924) (#3950)
https://github.com/python/cpython/commit/f15058a697de12b0efe6c7ebc38fe61a993bb5d5


--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31728] crashes in _elementtree due to unsafe decrefs of Element.text and Element.tail

[Oren Milman]

Change by Oren Milman :


--
pull_requests: +3925
stage: backport needed -> patch review

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31728] crashes in _elementtree due to unsafe decrefs of Element.text and Element.tail

[Serhiy Storchaka]

Change by Serhiy Storchaka :


--
stage: patch review -> backport needed
versions: +Python 2.7, Python 3.6

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31728] crashes in _elementtree due to unsafe decrefs of Element.text and Element.tail

[Serhiy Storchaka]

Serhiy Storchaka  added the comment:


New changeset a8ac71d15f2a4aef83a8954a678cc12545ce517c by Serhiy Storchaka 
(Miss Islington (bot)) in branch '3.6':
[3.6] bpo-31728: Prevent crashes in _elementtree due to unsafe cleanup of 
Element.text and Element.tail (GH-3924) (#3945)
https://github.com/python/cpython/commit/a8ac71d15f2a4aef83a8954a678cc12545ce517c


--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31728] crashes in _elementtree due to unsafe decrefs of Element.text and Element.tail

[Roundup Robot]

Change by Roundup Robot :


--
pull_requests: +3919

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31728] crashes in _elementtree due to unsafe decrefs of Element.text and Element.tail

[Serhiy Storchaka]

Serhiy Storchaka  added the comment:


New changeset 39ecb9c71b6e55d8a61a710d0144231bd88f9ada by Serhiy Storchaka 
(Oren Milman) in branch 'master':
bpo-31728: Prevent crashes in _elementtree due to unsafe cleanup of 
Element.text and Element.tail (#3924)
https://github.com/python/cpython/commit/39ecb9c71b6e55d8a61a710d0144231bd88f9ada


--
nosy: +serhiy.storchaka

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31728] crashes in _elementtree due to unsafe decrefs of Element.text and Element.tail

[Oren Milman]

Oren Milman  added the comment:

As serhiy pointed out in a comment in PR 3924, setting self->text or self->tail 
to
NULL might lead to an assertion failure, so we should also prevent the following
assertion failure (and the similar one for tail):
import xml.etree.ElementTree
class X:
def __del__(self):
elem.text

elem = xml.etree.ElementTree.Element('elem')
elem.text = X()
elem.__setstate__({'tag': None}) # implicitly also set elem.text to None

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31728] crashes in _elementtree due to unsafe decrefs of Element.text and Element.tail

[Oren Milman]

Change by Oren Milman :


--
keywords: +patch
pull_requests: +3897
stage:  -> patch review

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31728] crashes in _elementtree due to unsafe decrefs of Element.text and Element.tail

[Oren Milman]

New submission from Oren Milman :

The following code causes the interpreter to crash:
import xml.etree.ElementTree
class X:
def __del__(self):
elem.clear()
elem = xml.etree.ElementTree.Element('elem')
elem.text = X()
elem.clear()

This is because _elementtree_Element_clear_impl() decrefs self->text in an
unsafe manner.
For the same reason, but for self->tail, a crash would happen if we replaced
'elem.text = X()' with 'elem.tail = X()'.


Similarly, the following code also causes the interpreter to crash:
import xml.etree.ElementTree
class X:
def __del__(self):
elem.clear()
elem = xml.etree.ElementTree.Element('elem')
elem.text = X()
elem.text = X()

This is because element_text_setter() decrefs self->text in an unsafe manner.
element_tail_setter() does the same for self->tail, so again, if we replaced
'elem.text = X()' with 'elem.tail = X()', we would also get a crash.

--
components: XML
messages: 303917
nosy: Oren Milman
priority: normal
severity: normal
status: open
title: crashes in _elementtree due to unsafe decrefs of Element.text and 
Element.tail
type: crash
versions: Python 3.7

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com