mirrors/cpython
mirrors/cpython
0
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2024-11-24 17:47:13 +01:00
Code Issues Releases Activity

gh-115243: Fix crash in deque.index() when the deque is concurrently modified (GH-115247)

Browse Source
This commit is contained in:
kcatss 2024-02-15 01:08:26 +09:00 committed by GitHub
parent 81e140d10b
commit 671360161f
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
Lib/test/test_deque.py
View File

@ -166,7 +166,7 @@ class TestBasic(unittest.TestCase):
with self.assertRaises(RuntimeError): with self.assertRaises(RuntimeError):
n in d n in d
def test_contains_count_stop_crashes(self): def test_contains_count_index_stop_crashes(self):
class A: class A:
def __eq__(self, other): def __eq__(self, other):
d.clear() d.clear()
@ -178,6 +178,10 @@ class TestBasic(unittest.TestCase):
with self.assertRaises(RuntimeError): with self.assertRaises(RuntimeError):
_ = d.count(3) _ = d.count(3)
d = deque([A()])
with self.assertRaises(RuntimeError):
d.index(0)
def test_extend(self): def test_extend(self):
d = deque('a') d = deque('a')
self.assertRaises(TypeError, d.extend, 1) self.assertRaises(TypeError, d.extend, 1)

1
Misc/NEWS.d/next/Security/2024-02-12-00-33-01.gh-issue-115243.e1oGX8.rst Normal file
View File

@ -0,0 +1 @@
Fix possible crashes in :meth:`collections.deque.index` when the deque is concurrently modified.

3
Modules/_collectionsmodule.c
View File

@ -1218,8 +1218,9 @@ deque_index_impl(dequeobject *deque, PyObject *v, Py_ssize_t start,
n = stop - i; n = stop - i;
while (--n >= 0) { while (--n >= 0) {
CHECK_NOT_END(b); CHECK_NOT_END(b);
item = b->data[index]; item = Py_NewRef(b->data[index]);
cmp = PyObject_RichCompareBool(item, v, Py_EQ); cmp = PyObject_RichCompareBool(item, v, Py_EQ);
Py_DECREF(item);
if (cmp > 0) if (cmp > 0)
return PyLong_FromSsize_t(stop - n - 1); return PyLong_FromSsize_t(stop - n - 1);
if (cmp < 0) if (cmp < 0)