[backport to 3.5] bpo-29438: Fixed use-after-free in key sharing dict #40
Conversation
| @@ -3893,20 +3893,18 @@ _PyObjectDict_SetItem(PyTypeObject *tp, PyObject **dictptr, | |||
| } | |||
| if (value == NULL) { | |||
| res = PyDict_DelItem(dict, key); | |||
| if (cached != ((PyDictObject *)dict)->ma_keys) { | |||
There was a problem hiding this comment.
Why these lines are deleted?
There was a problem hiding this comment.
In Python 3.5, PyDict_DelItem won't resize dict. So cached == dict->ma_keys in most cases.
One exception is callback called by weakref or __del__ inserts some items to the dict and resize happened.
In this case, cached != CACHED_KEYS(tp), so DK_DECREF(cached) will be "use-after-free".
In such case, the insertion from the callback would update CACHED_KEYS(tp) correctly.
So clearing CACHED_KEYS(tp) doesn't make sense for most case.
Even when the callback inserts items through __dict__ (not regular attribute access), skipping CACHED_KEYS(tp) = NULL
doesn't cause uncontrolled memory growth. And it happens very rarely.
So I think this code is not worth enough.
No description provided.