Re: calling PyTasklet_New( NULL, ...) crashes
"Kruis, Anselm" <[email protected]> Sat, 15 Apr 2017 10:17:26 +0000
| Newsgroups | gmane.comp.python.stackless |
|---|---|
| Message-ID | <9302C84181E6764A99541EEA6F4E04C20297CC0F@DEERLM99EX3MSX.ww931.my-it-solutions.net> |
--===============6067917518115254659== Content-Language: de-DE Content-Type: multipart/alternative; boundary="_000_9302C84181E6764A99541EEA6F4E04C20297CC0FDEERLM99EX3MSXw_" --_000_9302C84181E6764A99541EEA6F4E04C20297CC0FDEERLM99EX3MSXw_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Jun, Many thanks for your report. I just created https://bitbucket.org/stackless= -dev/stackless/issues/129/calling-pytasklet_new-null-crashes for your repor= t. It is indeed a regression. I'll fix it soon. Stay tuned for the upcoming Stackless 3.5.3. CU Anselm Von: Stackless [mailto:[email protected]] Im Auftrag von Liu,= Jun Gesendet: Mittwoch, 12. April 2017 01:06 An: '[email protected]' Betreff: [Stackless] calling PyTasklet_New( NULL, ...) crashes Hi, I am using stackless python 3.4.2. I'd like to know if anyone that has use= d PyTasklet_New function encountered the same problem when passing in NULL = as the first argument. According to the documentation, "PyTaskletObject *PyTasklet_New(PyTypeObject *type, PyObject *func) Return a new tasklet object. type must be derived from PyTasklet_Type or NU= LL. func must be a callable object (normal use-case) or NULL, if the taskle= t is being used via capture()." But it crashes when I pass in NULL as first argument. I looked at the sourc= e code, and it is: PyTasklet_New(PyTypeObject *type, PyObject *func) { if (!PyType_IsSubtype(type, &PyTasklet_Type)) { PyErr_SetNone(PyExc_TypeError); return NULL; } ...... } int PyType_IsSubtype(PyTypeObject *a, PyTypeObject *b) { PyObject *mro; mro =3D a->tp_mro; .... } So the pointer is dereferenced without being checked thus causing the crash= ? Jun --_000_9302C84181E6764A99541EEA6F4E04C20297CC0FDEERLM99EX3MSXw_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:= //www.w3.org/TR/REC-html40"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <meta name=3D"Generator" content=3D"Microsoft Word 14 (filtered medium)"> <style><!-- /* Font Definitions */ @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:Tahoma; panose-1:2 11 6 4 3 5 4 4 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0cm; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri","sans-serif";} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:purple; text-decoration:underline;} p.MsoPlainText, li.MsoPlainText, div.MsoPlainText {mso-style-priority:99; mso-style-link:"Nur Text Zchn"; margin:0cm; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-fareast-language:EN-US;} p {mso-style-priority:99; mso-margin-top-alt:auto; margin-right:0cm; mso-margin-bottom-alt:auto; margin-left:0cm; font-size:12.0pt; font-family:"Times New Roman","serif";} code {mso-style-priority:99; font-family:"Courier New";} span.E-MailFormatvorlage19 {mso-style-type:personal; font-family:"Calibri","sans-serif"; color:windowtext;} span.sig-paren {mso-style-name:sig-paren;} span.apple-converted-space {mso-style-name:apple-converted-space;} span.pre {mso-style-name:pre;} span.E-MailFormatvorlage23 {mso-style-type:personal-reply; font-family:"Calibri","sans-serif"; color:#1F497D;} span.NurTextZchn {mso-style-name:"Nur Text Zchn"; mso-style-priority:99; mso-style-link:"Nur Text"; font-family:"Calibri","sans-serif"; mso-fareast-language:EN-US;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;} @page WordSection1 {size:612.0pt 792.0pt; margin:72.0pt 72.0pt 72.0pt 72.0pt;} div.WordSection1 {page:WordSection1;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--> </head> <body lang=3D"DE" link=3D"blue" vlink=3D"purple"> <div class=3D"WordSection1"> <p class=3D"MsoPlainText"><span lang=3D"EN-US">Hi Jun,<o:p></o:p></span></p= > <p class=3D"MsoPlainText"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoPlainText"><span lang=3D"EN-US">Many thanks for your report.= I just created </span><a href=3D"https://bitbucket.org/stackless-dev/stackless/issues/129/= calling-pytasklet_new-null-crashes"><span lang=3D"EN-US">https://bitbucket.= org/stackless-dev/stackless/issues/129/calling-pytasklet_new-null-crashes</= span></a><span lang=3D"EN-US"> for your report. It is indeed a regression. I’ll fix it soon. <o:p></o:p></sp= an></p> <p class=3D"MsoPlainText"><span lang=3D"EN-US">Stay tuned for the upcoming = Stackless 3.5.3.<o:p></o:p></span></p> <p class=3D"MsoPlainText"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoPlainText">CU Anselm<o:p></o:p></p> <p class=3D"MsoNormal"><span style=3D"color:#1F497D"><o:p> </o:p></spa= n></p> <p class=3D"MsoNormal"><span style=3D"color:#1F497D"><o:p> </o:p></spa= n></p> <div> <div style=3D"border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm = 0cm 0cm"> <p class=3D"MsoNormal"><b><span style=3D"font-size:10.0pt;font-family:"= ;Tahoma","sans-serif"">Von:</span></b><span style=3D"font-si= ze:10.0pt;font-family:"Tahoma","sans-serif""> Stackless= [mailto:[email protected]] <b>Im Auftrag von </b>Liu, Jun<br> <b>Gesendet:</b> Mittwoch, 12. April 2017 01:06<br> <b>An:</b> '[email protected]'<br> <b>Betreff:</b> [Stackless] calling PyTasklet_New( NULL, ...) crashes<o:p><= /o:p></span></p> </div> </div> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">Hi, <o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">I am using stackless python 3.4= .2. I’d like to know if anyone that has used PyTasklet_New func= tion encountered the same problem when passing in NULL as the first argumen= t. According to the documentation, <o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">“PyTaskletObject *PyTaskl= et_New(PyTypeObject *type, PyObject *func) <o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">Return a new tasklet object. ty= pe must be derived from PyTasklet_Type or NULL. func must be a callable obj= ect (normal use-case) or NULL, if the tasklet is being used via capture().&= #8220;<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">But it crashes when I pass in N= ULL as first argument. I looked at the source code, and it is:<o:p></o:p></= span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">PyTasklet_New(PyTypeObject *typ= e, PyObject *func)<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">{<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"> if (!PyType_= IsSubtype(type, &PyTasklet_Type)) {<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"> &= nbsp; PyErr_SetNone(PyExc_TypeError);<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"> &= nbsp; return NULL;<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"> }<o:p></o:p>= </span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"> ......<o:p><= /o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">}<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">int<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">PyType_IsSubtype(PyTypeObject *= a, PyTypeObject *b)<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">{<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"> PyObject *mr= o;<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"> mro =3D a-&g= t;tp_mro;<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"> &= nbsp; ....<o:p></o:p>= </span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">}<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">So the pointer is dereferenced = without being checked thus causing the crash?<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">Jun<o:p></o:p></span></p> </div> </body> </html> --_000_9302C84181E6764A99541EEA6F4E04C20297CC0FDEERLM99EX3MSXw_-- --===============6067917518115254659== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KU3RhY2tsZXNz IG1haWxpbmcgbGlzdApTdGFja2xlc3NAc3RhY2tsZXNzLmNvbQpodHRwOi8vd3d3LnN0YWNrbGVz cy5jb20vbWFpbG1hbi9saXN0aW5mby9zdGFja2xlc3M= --===============6067917518115254659==--