➜

This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: crash in longobject (invalid memory access)
Type: Stage:
Components: Interpreter Core Versions:
process
Status: closed Resolution: duplicate
Dependencies: Superseder:
Assigned To: Nosy List: jnelson, tim.peters
Priority: normal Keywords:

Created on 2005-10-05 20:03 by jnelson, last changed 2022-04-11 14:56 by admin. This issue is now closed.

Messages (2)
msg26518 - (view) Author: Jon Nelson (jnelson) Date: 2005-10-05 20:03 
While debugging a memory consumption problem, I disable
pymalloc and found a crasher in longobject.c, line 2518
(Python 2.4.1).

The code currently reads:

    Py_XDECREF(a);
    Py_XDECREF(b);
    Py_XDECREF(c);
    Py_XDECREF(temp);
    if (b->ob_size > FIVEARY_CUTOFF) {
        for (i = 0; i < 32; ++i)
            Py_XDECREF(table[i]);
    }
    return (PyObject *)z;

It *should* read:

    Py_XDECREF(a);
    Py_XDECREF(c);
    Py_XDECREF(temp);
    if (b->ob_size > FIVEARY_CUTOFF) {
        for (i = 0; i < 32; ++i)
            Py_XDECREF(table[i]);
    }
    Py_XDECREF(b);
    return (PyObject *)z;

because without the change you clearly access "b"
*after* freeing it.
msg26519 - (view) Author: Tim Peters (tim.peters) * (Python committer) Date: 2005-10-05 20:54 
Logged In: YES 
user_id=31435

This is a duplicate of bug 1238681 (& already fixed).
History
Date User Action Args
2022-04-11 14:56:13adminsetgithub: 42452
2005-10-05 20:03:18jnelsoncreate