[PyObjC-svn] r2413 - in trunk/pyobjc/pyobjc-core: . Modules/objc

Author: ronaldoussoren
Date: Wed Mar 10 16:59:07 2010
New Revision: 2413

Log:
Fix crash in objc.object_property(dynamic=True) due
to unlimited recursion.


Modified:
   trunk/pyobjc/pyobjc-core/Modules/objc/method-accessor.m
   trunk/pyobjc/pyobjc-core/NEWS.txt

Modified: trunk/pyobjc/pyobjc-core/Modules/objc/method-accessor.m
==============================================================================
--- trunk/pyobjc/pyobjc-core/Modules/objc/method-accessor.m	(original)
+++ trunk/pyobjc/pyobjc-core/Modules/objc/method-accessor.m	Wed Mar 10 16:59:07 2010
@@ -99,7 +99,6 @@
 	if (flattened == NULL) {
 		return NULL;
 	}
-
 	return PyObjCSelector_NewNative((Class)objc_object, sel,
 		flattened, class_method);
 }
@@ -301,9 +300,18 @@
 		}
 
 	} else {
-		if (PyObjCClass_Check(self->base)) {
+		if (PyObjCClass_Check(self->base) || PyObjCObject_Check(self->base)) {
 			/* Walk the mro and look in the class dict */
-			PyObject* mro = ((PyTypeObject*)self->base)->tp_mro;
+			PyObject* mro;
+			PyObject* descr_arg;
+			
+			if (PyObjCClass_Check(self->base)) {
+				mro = ((PyTypeObject*)self->base)->tp_mro;
+				descr_arg = NULL;
+			} else {
+				mro = (Py_TYPE(self->base))->tp_mro;
+				descr_arg = self->base;
+			}
 			Py_ssize_t i, len;
 
 			len = PyTuple_GET_SIZE(mro);
@@ -319,11 +327,14 @@
 						 * descriptor mechanism to
 						 * fetch the actual result
 						 */
-						v = Py_TYPE(v)->tp_descr_get(v, NULL, (PyObject*)Py_TYPE(v));
+						v = Py_TYPE(v)->tp_descr_get(v, descr_arg, (PyObject*)Py_TYPE(v));
 						result = v;
 						Py_INCREF(result);
-						break;
 					}
+					/* Found an item with the specified 
+					 * name, abort the search.
+					 */
+					break;
 				}
 			}
 	
@@ -353,14 +364,17 @@
 	if (self->class_method && PyObjCObject_Check(self->base)) {
 		/* Class method */
 		((PyObjCSelector*)result)->sel_self = (PyObject*)(Py_TYPE(self->base));
+		Py_INCREF(Py_TYPE(self->base));
 	} else if (!self->class_method && PyObjCClass_Check(self->base)) {
 		/* Unbound instance method */
 		((PyObjCSelector*)result)->sel_self = NULL;
 	} else {
 		/* Bound instance method */
 		((PyObjCSelector*)result)->sel_self = self->base;
+		Py_INCREF(self->base);
+
 	}
-	Py_XINCREF(((PyObjCSelector*)result)->sel_self);
+	/*Py_XINCREF(((PyObjCSelector*)result)->sel_self);*/
 	Py_DECREF(name_bytes);
 	return result;
 }

Modified: trunk/pyobjc/pyobjc-core/NEWS.txt
==============================================================================
--- trunk/pyobjc/pyobjc-core/NEWS.txt	(original)
+++ trunk/pyobjc/pyobjc-core/NEWS.txt	Wed Mar 10 16:59:07 2010
@@ -7,6 +7,11 @@
 Version 2.3a0
 -------------
 
+- BUGFIX: accessing methods through ``anObject.pyobjc_instancMethods`` is
+  now safer, before this release this could cause unlimited recursion
+  (although I'm not sure if it was possible to trigger this without
+  other changes in this release).
+
 - The PyObjC egg now includes the header files that should be used to
   compile to compile the extensions in the framework wrappers, which makes
   it a lot easier to access those headers.

------------------------------------------------------------------------------
Download Intel® Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev