Skip to content

Commit 7486ffe

Browse files
committed
Issue #18560: Fix potential NULL pointer dereference in sum()
2 parents c4ee8df + 647c7bd commit 7486ffe

994 files changed

Lines changed: 62836 additions & 76546 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.gitignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,13 @@ Doc/tools/jinja2/
1515
Doc/tools/pygments/
1616
Doc/tools/sphinx/
1717
Lib/lib2to3/*.pickle
18+
Lib/test/data/*
1819
Lib/_sysconfigdata.py
1920
Lib/plat-mac/errors.rsrc.df.rsrc
2021
Makefile
2122
Makefile.pre
2223
Misc/python.pc
24+
Misc/python-config.sh
2325
Modules/Setup
2426
Modules/Setup.config
2527
Modules/Setup.local
@@ -57,6 +59,8 @@ platform
5759
pybuilddir.txt
5860
pyconfig.h
5961
python
62+
python-config
63+
python-config.py
6064
python.exe
6165
python-gdb.py
6266
python.exe-gdb.py

.hgignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ platform$
1818
pyconfig.h$
1919
python$
2020
python.exe$
21+
python-config$
22+
python-config.py$
2123
reflog.txt$
2224
tags$
2325
Lib/plat-mac/errors.rsrc.df.rsrc
@@ -27,6 +29,7 @@ Doc/tools/jinja/
2729
Doc/tools/jinja2/
2830
Doc/tools/pygments/
2931
Misc/python.pc
32+
Misc/python-config.sh$
3033
Modules/Setup$
3134
Modules/Setup.config
3235
Modules/Setup.local

Doc/c-api/dict.rst

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,15 @@ Dictionary Objects
110110
:c:type:`char\*`, rather than a :c:type:`PyObject\*`.
111111
112112
113+
.. c:function:: PyObject* PyDict_SetDefault(PyObject *p, PyObject *key, PyObject *default)
114+
115+
This is the same as the Python-level :meth:`dict.setdefault`. If present, it
116+
returns the value corresponding to *key* from the dictionary *p*. If the key
117+
is not in the dict, it is inserted with value *defaultobj* and *defaultobj*
118+
is returned. This function evaluates the hash function of *key* only once,
119+
instead of evaluating it independently for the lookup and the insertion.
120+
121+
113122
.. c:function:: PyObject* PyDict_Items(PyObject *p)
114123
115124
Return a :c:type:`PyListObject` containing all the items from the dictionary.

Doc/c-api/init.rst

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -654,6 +654,20 @@ with sub-interpreters:
654654
made on the main thread. This is mainly a helper/diagnostic function.
655655
656656
657+
.. c:function:: int PyGILState_Check()
658+
659+
Return 1 if the current thread is holding the GIL and 0 otherwise.
660+
This function can be called from any thread at any time.
661+
Only if it has had its Python thread state initialized and currently is
662+
holding the GIL will it return 1.
663+
This is mainly a helper/diagnostic function. It can be useful
664+
for example in callback contexts or memory allocation functions when
665+
knowing that the GIL is locked can allow the caller to perform sensitive
666+
actions or otherwise behave differently.
667+
668+
.. versionadded:: 3.4
669+
670+
657671
The following macros are normally used without a trailing semicolon; look for
658672
example usage in the Python source distribution.
659673

Doc/c-api/memory.rst

Lines changed: 170 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,15 +84,65 @@ the C library allocator as shown in the previous example, the allocated memory
8484
for the I/O buffer escapes completely the Python memory manager.
8585

8686

87+
Raw Memory Interface
88+
====================
89+
90+
The following function sets are wrappers to the system allocator. These
91+
functions are thread-safe, the :term:`GIL <global interpreter lock>` does not
92+
need to be held.
93+
94+
The default raw memory block allocator uses the following functions:
95+
:c:func:`malloc`, :c:func:`realloc` and :c:func:`free`; call ``malloc(1)`` when
96+
requesting zero bytes.
97+
98+
.. versionadded:: 3.4
99+
100+
.. c:function:: void* PyMem_RawMalloc(size_t n)
101+
102+
Allocates *n* bytes and returns a pointer of type :c:type:`void\*` to the
103+
allocated memory, or *NULL* if the request fails. Requesting zero bytes
104+
returns a distinct non-*NULL* pointer if possible, as if
105+
``PyMem_RawMalloc(1)`` had been called instead. The memory will not have
106+
been initialized in any way.
107+
108+
109+
.. c:function:: void* PyMem_RawRealloc(void *p, size_t n)
110+
111+
Resizes the memory block pointed to by *p* to *n* bytes. The contents will
112+
be unchanged to the minimum of the old and the new sizes. If *p* is *NULL*,
113+
the call is equivalent to ``PyMem_RawMalloc(n)``; else if *n* is equal to
114+
zero, the memory block is resized but is not freed, and the returned pointer
115+
is non-*NULL*. Unless *p* is *NULL*, it must have been returned by a
116+
previous call to :c:func:`PyMem_RawMalloc` or :c:func:`PyMem_RawRealloc`. If
117+
the request fails, :c:func:`PyMem_RawRealloc` returns *NULL* and *p* remains
118+
a valid pointer to the previous memory area.
119+
120+
121+
.. c:function:: void PyMem_RawFree(void *p)
122+
123+
Frees the memory block pointed to by *p*, which must have been returned by a
124+
previous call to :c:func:`PyMem_RawMalloc` or :c:func:`PyMem_RawRealloc`.
125+
Otherwise, or if ``PyMem_Free(p)`` has been called before, undefined
126+
behavior occurs. If *p* is *NULL*, no operation is performed.
127+
128+
87129
.. _memoryinterface:
88130
89131
Memory Interface
90132
================
91133
92134
The following function sets, modeled after the ANSI C standard, but specifying
93135
behavior when requesting zero bytes, are available for allocating and releasing
94-
memory from the Python heap:
136+
memory from the Python heap.
137+
138+
The default memory block allocator uses the following functions:
139+
:c:func:`malloc`, :c:func:`realloc` and :c:func:`free`; call ``malloc(1)`` when
140+
requesting zero bytes.
141+
142+
.. warning::
95143
144+
The :term:`GIL <global interpreter lock>` must be held when using these
145+
functions.
96146
97147
.. c:function:: void* PyMem_Malloc(size_t n)
98148
@@ -155,6 +205,125 @@ versions and is therefore deprecated in extension modules.
155205
:c:func:`PyMem_NEW`, :c:func:`PyMem_RESIZE`, :c:func:`PyMem_DEL`.
156206
157207
208+
Customize Memory Allocators
209+
===========================
210+
211+
.. versionadded:: 3.4
212+
213+
.. c:type:: PyMemAllocator
214+
215+
Structure used to describe a memory block allocator. The structure has
216+
four fields:
217+
218+
+----------------------------------------------------------+---------------------------------------+
219+
| Field | Meaning |
220+
+==========================================================+=======================================+
221+
| ``void *ctx`` | user context passed as first argument |
222+
+----------------------------------------------------------+---------------------------------------+
223+
| ``void* malloc(void *ctx, size_t size)`` | allocate a memory block |
224+
+----------------------------------------------------------+---------------------------------------+
225+
| ``void* realloc(void *ctx, void *ptr, size_t new_size)`` | allocate or resize a memory block |
226+
+----------------------------------------------------------+---------------------------------------+
227+
| ``void free(void *ctx, void *ptr)`` | free a memory block |
228+
+----------------------------------------------------------+---------------------------------------+
229+
230+
.. c:type:: PyMemAllocatorDomain
231+
232+
Enum used to identify an allocator domain. Domains:
233+
234+
* :c:data:`PYMEM_DOMAIN_RAW`: functions :c:func:`PyMem_RawMalloc`,
235+
:c:func:`PyMem_RawRealloc` and :c:func:`PyMem_RawFree`
236+
* :c:data:`PYMEM_DOMAIN_MEM`: functions :c:func:`PyMem_Malloc`,
237+
:c:func:`PyMem_Realloc` and :c:func:`PyMem_Free`
238+
* :c:data:`PYMEM_DOMAIN_OBJ`: functions :c:func:`PyObject_Malloc`,
239+
:c:func:`PyObject_Realloc` and :c:func:`PyObject_Free`
240+
241+
242+
.. c:function:: void PyMem_GetAllocator(PyMemAllocatorDomain domain, PyMemAllocator *allocator)
243+
244+
Get the memory block allocator of the specified domain.
245+
246+
247+
.. c:function:: void PyMem_SetAllocator(PyMemAllocatorDomain domain, PyMemAllocator *allocator)
248+
249+
Set the memory block allocator of the specified domain.
250+
251+
The new allocator must return a distinct non-NULL pointer when requesting
252+
zero bytes.
253+
254+
For the :c:data:`PYMEM_DOMAIN_RAW` domain, the allocator must be
255+
thread-safe: the :term:`GIL <global interpreter lock>` is not held when the
256+
allocator is called.
257+
258+
If the new allocator is not a hook (does not call the previous allocator),
259+
the :c:func:`PyMem_SetupDebugHooks` function must be called to reinstall the
260+
debug hooks on top on the new allocator.
261+
262+
263+
.. c:function:: void PyMem_SetupDebugHooks(void)
264+
265+
Setup hooks to detect bugs in the following Python memory allocator
266+
functions:
267+
268+
- :c:func:`PyMem_RawMalloc`, :c:func:`PyMem_RawRealloc`,
269+
:c:func:`PyMem_RawFree`
270+
- :c:func:`PyMem_Malloc`, :c:func:`PyMem_Realloc`, :c:func:`PyMem_Free`
271+
- :c:func:`PyObject_Malloc`, :c:func:`PyObject_Realloc`,
272+
:c:func:`PyObject_Free`
273+
274+
Newly allocated memory is filled with the byte ``0xCB``, freed memory is
275+
filled with the byte ``0xDB``. Additionnal checks:
276+
277+
- detect API violations, ex: :c:func:`PyObject_Free` called on a buffer
278+
allocated by :c:func:`PyMem_Malloc`
279+
- detect write before the start of the buffer (buffer underflow)
280+
- detect write after the end of the buffer (buffer overflow)
281+
282+
The function does nothing if Python is not compiled is debug mode.
283+
284+
285+
Customize PyObject Arena Allocator
286+
==================================
287+
288+
Python has a *pymalloc* allocator for allocations smaller than 512 bytes. This
289+
allocator is optimized for small objects with a short lifetime. It uses memory
290+
mappings called "arenas" with a fixed size of 256 KB. It falls back to
291+
:c:func:`PyMem_Malloc` and :c:func:`PyMem_Realloc` for allocations larger than
292+
512 bytes. *pymalloc* is the default allocator used by
293+
:c:func:`PyObject_Malloc`.
294+
295+
The default arena allocator uses the following functions:
296+
297+
* :c:func:`VirtualAlloc` and :c:func:`VirtualFree` on Windows,
298+
* :c:func:`mmap` and :c:func:`munmap` if available,
299+
* :c:func:`malloc` and :c:func:`free` otherwise.
300+
301+
.. versionadded:: 3.4
302+
303+
.. c:type:: PyObjectArenaAllocator
304+
305+
Structure used to describe an arena allocator. The structure has
306+
three fields:
307+
308+
+--------------------------------------------------+---------------------------------------+
309+
| Field | Meaning |
310+
+==================================================+=======================================+
311+
| ``void *ctx`` | user context passed as first argument |
312+
+--------------------------------------------------+---------------------------------------+
313+
| ``void* alloc(void *ctx, size_t size)`` | allocate an arena of size bytes |
314+
+--------------------------------------------------+---------------------------------------+
315+
| ``void free(void *ctx, size_t size, void *ptr)`` | free an arena |
316+
+--------------------------------------------------+---------------------------------------+
317+
318+
.. c:function:: PyObject_GetArenaAllocator(PyObjectArenaAllocator *allocator)
319+
320+
Get the arena allocator.
321+
322+
.. c:function:: PyObject_SetArenaAllocator(PyObjectArenaAllocator *allocator)
323+
324+
Set the arena allocator.
325+
326+
158327
.. _memoryexamples:
159328
160329
Examples

Doc/c-api/module.rst

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,13 +35,20 @@ There are only a few functions special to module objects.
3535
single: __name__ (module attribute)
3636
single: __doc__ (module attribute)
3737
single: __file__ (module attribute)
38+
single: __package__ (module attribute)
39+
single: __loader__ (module attribute)
3840
3941
Return a new module object with the :attr:`__name__` attribute set to *name*.
40-
Only the module's :attr:`__doc__` and :attr:`__name__` attributes are filled in;
41-
the caller is responsible for providing a :attr:`__file__` attribute.
42+
The module's :attr:`__name__`, :attr:`__doc__`, :attr:`__package__`, and
43+
:attr:`__loader__` attributes are filled in (all but :attr:`__name__` are set
44+
to ``None``); the caller is responsible for providing a :attr:`__file__`
45+
attribute.
4246
4347
.. versionadded:: 3.3
4448
49+
.. versionchanged:: 3.4
50+
:attr:`__package__` and :attr:`__loader__` are set to ``None``.
51+
4552
4653
.. c:function:: PyObject* PyModule_New(const char *name)
4754

Doc/c-api/object.rst

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -240,7 +240,7 @@ is considered sufficient for this determination.
240240
of the Python expression ``callable_object(*args)``.
241241
242242
243-
.. c:function:: PyObject* PyObject_CallFunction(PyObject *callable, char *format, ...)
243+
.. c:function:: PyObject* PyObject_CallFunction(PyObject *callable, const char *format, ...)
244244
245245
Call a callable Python object *callable*, with a variable number of C arguments.
246246
The C arguments are described using a :c:func:`Py_BuildValue` style format
@@ -250,8 +250,11 @@ is considered sufficient for this determination.
250250
pass :c:type:`PyObject \*` args, :c:func:`PyObject_CallFunctionObjArgs` is a
251251
faster alternative.
252252
253+
.. versionchanged:: 3.4
254+
The type of *format* was changed from ``char *``.
253255
254-
.. c:function:: PyObject* PyObject_CallMethod(PyObject *o, char *method, char *format, ...)
256+
257+
.. c:function:: PyObject* PyObject_CallMethod(PyObject *o, const char *method, const char *format, ...)
255258
256259
Call the method named *method* of object *o* with a variable number of C
257260
arguments. The C arguments are described by a :c:func:`Py_BuildValue` format
@@ -261,6 +264,9 @@ is considered sufficient for this determination.
261264
Note that if you only pass :c:type:`PyObject \*` args,
262265
:c:func:`PyObject_CallMethodObjArgs` is a faster alternative.
263266
267+
.. versionchanged:: 3.4
268+
The types of *method* and *format* were changed from ``char *``.
269+
264270
265271
.. c:function:: PyObject* PyObject_CallFunctionObjArgs(PyObject *callable, ..., NULL)
266272
@@ -342,6 +348,15 @@ is considered sufficient for this determination.
342348
returned. This is the equivalent to the Python expression ``len(o)``.
343349
344350
351+
.. c:function:: Py_ssize_t PyObject_LengthHint(PyObject *o, Py_ssize_t default)
352+
353+
Return an estimated length for the object *o*. First trying to return its
354+
actual length, then an estimate using ``__length_hint__``, and finally
355+
returning the default value. On error ``-1`` is returned. This is the
356+
equivalent to the Python expression ``operator.length_hint(o, default)``.
357+
358+
.. versionadded:: 3.4
359+
345360
.. c:function:: PyObject* PyObject_GetItem(PyObject *o, PyObject *key)
346361
347362
Return element of *o* corresponding to the object *key* or *NULL* on failure.

Doc/c-api/unicode.rst

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -526,12 +526,23 @@ APIs:
526526
The `"%lld"` and `"%llu"` format specifiers are only available
527527
when :const:`HAVE_LONG_LONG` is defined.
528528
529+
.. note::
530+
The width formatter unit is number of characters rather than bytes.
531+
The precision formatter unit is number of bytes for ``"%s"`` and
532+
``"%V"`` (if the ``PyObject*`` argument is NULL), and a number of
533+
characters for ``"%A"``, ``"%U"``, ``"%S"``, ``"%R"`` and ``"%V"``
534+
(if the ``PyObject*`` argument is not NULL).
535+
529536
.. versionchanged:: 3.2
530537
Support for ``"%lld"`` and ``"%llu"`` added.
531538
532539
.. versionchanged:: 3.3
533540
Support for ``"%li"``, ``"%lli"`` and ``"%zi"`` added.
534541
542+
.. versionchanged:: 3.4
543+
Support width and precision formatter for ``"%s"``, ``"%A"``, ``"%U"``,
544+
``"%V"``, ``"%S"``, ``"%R"`` added.
545+
535546
536547
.. c:function:: PyObject* PyUnicode_FromFormatV(const char *format, va_list vargs)
537548

Doc/c-api/veryhigh.rst

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,29 @@ the same library that the Python runtime is using.
144144
(:func:`sys.getfilesystemencoding`). Returns ``0`` at EOF.
145145
146146
147+
.. c:var:: int (*PyOS_InputHook)(void)
148+
149+
Can be set to point to a function with the prototype
150+
``int func(void)``. The function will be called when Python's
151+
interpreter prompt is about to become idle and wait for user input
152+
from the terminal. The return value is ignored. Overriding this
153+
hook can be used to integrate the interpreter's prompt with other
154+
event loops, as done in the :file:`Modules/_tkinter.c` in the
155+
Python source code.
156+
157+
158+
.. c:var:: char* (*PyOS_ReadlineFunctionPointer)(FILE *, FILE *, char *)
159+
160+
Can be set to point to a function with the prototype
161+
``char *func(FILE *stdin, FILE *stdout, char *prompt)``,
162+
overriding the default function used to read a single line of input
163+
at the interpreter's prompt. The function is expected to output
164+
the string *prompt* if it's not *NULL*, and then read a line of
165+
input from the provided standard input file, returning the
166+
resulting string. For example, The :mod:`readline` module sets
167+
this hook to provide line-editing and tab-completion features.
168+
169+
147170
.. c:function:: struct _node* PyParser_SimpleParseString(const char *str, int start)
148171
149172
This is a simplified interface to
@@ -338,4 +361,3 @@ the same library that the Python runtime is using.
338361
339362
This bit can be set in *flags* to cause division operator ``/`` to be
340363
interpreted as "true division" according to :pep:`238`.
341-

0 commit comments

Comments
 (0)