[issue24097] Use after free in PyObject_GetState

Changes by Serhiy Storchaka : -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker ___ _

[issue24097] Use after free in PyObject_GetState

Roundup Robot added the comment: New changeset eed36e19f8b8 by Serhiy Storchaka in branch '3.4': Issue #24097: Fixed crash in object.__reduce__() if slot name is freed inside https://hg.python.org/cpython/rev/eed36e19f8b8 New changeset 99839a1c9c6d by Serhiy Storchaka in branch '3.5': Issue #240

[issue24097] Use after free in PyObject_GetState

Changes by Serhiy Storchaka : Added file: http://bugs.python.org/file40937/getstate_borrowed_ref_with_test-3.4.patch ___ Python tracker ___ _

[issue24097] Use after free in PyObject_GetState

Serhiy Storchaka added the comment: Here is backported to 2.7 patch with test. Can you review the test and commit the patch Antoine? -- assignee: serhiy.storchaka -> pitrou Added file: http://bugs.python.org/file40936/getstate_borrowed_ref_with_test-2.7.patch _

[issue24097] Use after free in PyObject_GetState

Serhiy Storchaka added the comment: In 2.7 the test doesn't crash, but __reduce__ produces invalid recursive structure. -- versions: +Python 2.7 ___ Python tracker ___ _

[issue24097] Use after free in PyObject_GetState

Changes by Serhiy Storchaka : -- assignee: pitrou -> serhiy.storchaka ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubsc

[issue24097] Use after free in PyObject_GetState

Serhiy Storchaka added the comment: Here is a test for this issue. -- stage: test needed -> patch review Added file: http://bugs.python.org/file39953/test_issue24097.patch ___ Python tracker ___

[issue24097] Use after free in PyObject_GetState

Serhiy Storchaka added the comment: The fix LGTM. It would be nice to add a test. -- assignee: serhiy.storchaka -> pitrou stage: patch review -> test needed ___ Python tracker _

[issue24097] Use after free in PyObject_GetState

Benjamin Peterson added the comment: lgtm -- nosy: +benjamin.peterson ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubsc

[issue24097] Use after free in PyObject_GetState

Changes by Antoine Pitrou : -- keywords: +patch Added file: http://bugs.python.org/file39842/getstate_borrowed_ref.patch ___ Python tracker ___ __

[issue24097] Use after free in PyObject_GetState

Changes by Antoine Pitrou : -- stage: needs patch -> patch review versions: +Python 3.6 ___ Python tracker ___ ___ Python-bugs-list ma

[issue24097] Use after free in PyObject_GetState

Antoine Pitrou added the comment: Thanks for the report. Here is a patch. -- ___ Python tracker ___ ___ Python-bugs-list mailing list

[issue24097] Use after free in PyObject_GetState

Changes by Serhiy Storchaka : -- assignee: -> serhiy.storchaka ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue24097] Use after free in PyObject_GetState

paul added the comment: ping -- ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman

[issue24097] Use after free in PyObject_GetState

Changes by Arfrever Frehtes Taifersar Arahesis : -- nosy: +Arfrever ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscri

[issue24097] Use after free in PyObject_GetState

Changes by Serhiy Storchaka : -- nosy: +alexandre.vassalotti, pitrou, serhiy.storchaka ___ Python tracker ___ ___ Python-bugs-list mai

[issue24097] Use after free in PyObject_GetState

Changes by Christian Heimes : -- components: +Extension Modules stage: -> needs patch versions: +Python 3.5 ___ Python tracker ___ __

[issue24097] Use after free in PyObject_GetState

New submission from paul: # Program received signal SIGSEGV, Segmentation fault. # 0x080f27b2 in PyObject_Hash (v=) at Objects/object.c:746 # 746 if (tp->tp_hash != NULL) # (gdb) bt # #0 0x080f27b2 in PyObject_Hash (v=) at Objects/object.c:746 # #1 0x080e1717 in PyDict_SetItem (op={},