[issue24407] Use after free in PyDict_merge

Changes by Arfrever Frehtes Taifersar Arahesis : -- nosy: +Arfrever ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscri

[issue24407] Use after free in PyDict_merge

Roundup Robot added the comment: New changeset 37fed8b02f00 by Benjamin Peterson in branch '3.3': protect against mutation of the dict during insertion (closes #24407) https://hg.python.org/cpython/rev/37fed8b02f00 New changeset 75da5acbfbe4 by Benjamin Peterson in branch '3.4': merge 3.3 (#2440

[issue24407] Use after free in PyDict_merge

R. David Murray added the comment: Oh, he still might have written the patch, after all there isn't a lot of operational difference between the email that says "assigned to XXX" and the email that contains your text "consider this assigned". However, Benjamin has given you developer privs on t

[issue24407] Use after free in PyDict_merge

Mark Shannon added the comment: If the tracker had let me assign the issue, you need not have wasted your time. Oh well. Indeed, your patch looks very similar to mine. -- ___ Python tracker __

[issue24407] Use after free in PyDict_merge

Benjamin Peterson added the comment: Hmm, I just wrote a very similar patch. Tell me what you think. :) -- nosy: +benjamin.peterson Added file: http://bugs.python.org/file39861/dict_merge.patch ___ Python tracker _

[issue24407] Use after free in PyDict_merge

Mark Shannon added the comment: There are two parts to this fix. First, we raise a runtime exception if the other dict is modified during the update/merge. Second, refcounts must be incremented around the PyDict_GetItem and insertdict calls in case the key or value is otherwise deallocated.

[issue24407] Use after free in PyDict_merge

Mark Shannon added the comment: The tracker won't let me assign this to myself. Consider it assigned. -- nosy: +Mark.Shannon ___ Python tracker ___ __

[issue24407] Use after free in PyDict_merge

Berker Peksag added the comment: Thanks for the report, paul. Please do not ping an issue after a day. Quoting from https://docs.python.org/devguide/patch.html?#reviewing "If your patch has not received any notice from reviewers (i.e., no comment made) after one month, first “ping” the issue o

[issue24407] Use after free in PyDict_merge

paul added the comment: ping -- ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman

[issue24407] Use after free in PyDict_merge

paul added the comment: ping -- ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman

[issue24407] Use after free in PyDict_merge

paul added the comment: ping -- ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman

[issue24407] Use after free in PyDict_merge

Changes by Serhiy Storchaka : -- components: +Interpreter Core nosy: +rhettinger, serhiy.storchaka stage: -> needs patch ___ Python tracker ___ _

[issue24407] Use after free in PyDict_merge

New submission from paul: # PyDict_Merge: # # 1 for (i = 0, n = DK_SIZE(other->ma_keys); i < n; i++) { # ... # 3 entry = &other->ma_keys->dk_entries[i]; # ... # 2 if (insertdict(mp, entry->me_key, #entry->me_ha