pythongh-102356: Add thrashcan macros to filter object dealloc (python#102426)

mgmacias95 · hugovk · commit 028b26a7ae09 · 2023-03-06T14:51:21.000+02:00
Add thrashcan macros to the deallocator of the filter objects to protect against deeply nested destruction of chains of nested filters.
diff --git a/Lib/test/test_builtin.py b/Lib/test/test_builtin.py
@@ -926,6 +926,16 @@ def test_filter_pickle(self):
             f2 = filter(filter_char, "abcdeabcde")
             self.check_iter_pickle(f1, list(f2), proto)
 
+    def test_filter_dealloc(self):
+        # Tests recursive deallocation of nested filter objects using the
+        # thrashcan mechanism. See gh-102356 for more details.
+        max_iters = 1000000
+        i = filter(bool, range(max_iters))
+        for _ in range(max_iters):
+            i = filter(bool, i)
+        del i
+        gc.collect()
+
     def test_getattr(self):
         self.assertTrue(getattr(sys, 'stdout') is sys.stdout)
         self.assertRaises(TypeError, getattr)
diff --git a/Misc/ACKS b/Misc/ACKS
@@ -637,6 +637,7 @@ Tim Golden
 Yonatan Goldschmidt
 Mark Gollahon
 Mikhail Golubev
+Marta Gómez Macías
 Guilherme Gonçalves
 Tiago Gonçalves
 Chris Gonnerman
diff --git a/Misc/NEWS.d/next/Core and Builtins/2023-03-04-20-56-12.gh-issue-102356.07KvUd.rst b/Misc/NEWS.d/next/Core and Builtins/2023-03-04-20-56-12.gh-issue-102356.07KvUd.rst
@@ -0,0 +1,2 @@
+Fix a bug that caused a crash when deallocating deeply nested filter
+objects. Patch by Marta Gómez Macías.
diff --git a/Python/bltinmodule.c b/Python/bltinmodule.c
@@ -553,9 +553,11 @@ static void
 filter_dealloc(filterobject *lz)
 {
     PyObject_GC_UnTrack(lz);
+    Py_TRASHCAN_BEGIN(lz, filter_dealloc)
     Py_XDECREF(lz->func);
     Py_XDECREF(lz->it);
     Py_TYPE(lz)->tp_free(lz);
+    Py_TRASHCAN_END
 }
 
 static int

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+Fix a bug that caused a crash when deallocating deeply nested filter`
	`2`	`+objects. Patch by Marta Gómez Macías.`
Original file line number	Diff line number	Diff line change
`@@ -553,9 +553,11 @@ static void`
`553`	`553`	`filter_dealloc(filterobject *lz)`
`554`	`554`	`{`
`555`	`555`	`PyObject_GC_UnTrack(lz);`
	`556`	`+ Py_TRASHCAN_BEGIN(lz, filter_dealloc)`
`556`	`557`	`Py_XDECREF(lz->func);`
`557`	`558`	`Py_XDECREF(lz->it);`
`558`	`559`	`Py_TYPE(lz)->tp_free(lz);`
	`560`	`+ Py_TRASHCAN_END`
`559`	`561`	`}`
`560`	`562`
`561`	`563`	`static int`