closes bpo-39091: Fix segfault when Exception constructor returns non-exception for gen.throw. (python#17658)

coolreader18 · benjaminp · web-flow · commit 83ca46b7784b · 2021-08-02T19:17:18.000-07:00
Co-authored-by: Benjamin Peterson &lt;benjamin@python.org&gt;
diff --git a/Lib/test/test_generators.py b/Lib/test/test_generators.py
@@ -270,6 +270,32 @@ def gen():
         self.assertEqual(next(g), "done")
         self.assertEqual(sys.exc_info(), (None, None, None))
 
+    def test_except_throw_bad_exception(self):
+        class E(Exception):
+            def __new__(cls, *args, **kwargs):
+                return cls
+
+        def boring_generator():
+            yield
+
+        gen = boring_generator()
+
+        err_msg = 'should have returned an instance of BaseException'
+
+        with self.assertRaisesRegex(TypeError, err_msg):
+            gen.throw(E)
+
+        self.assertRaises(StopIteration, next, gen)
+
+        def generator():
+            with self.assertRaisesRegex(TypeError, err_msg):
+                yield
+
+        gen = generator()
+        next(gen)
+        with self.assertRaises(StopIteration):
+            gen.throw(E)
+
     def test_stopiteration_error(self):
         # See also PEP 479.
 
diff --git a/Misc/ACKS b/Misc/ACKS
@@ -1300,6 +1300,7 @@ Peter Otten
 Michael Otteneder
 Richard Oudkerk
 Russel Owen
+Noah Oxer
 Joonas Paalasmaa
 Yaroslav Pankovych
 Martin Packman
diff --git a/Misc/NEWS.d/next/Core and Builtins/2019-12-21-14-18-32.bpo-39091.dOexgQ.rst b/Misc/NEWS.d/next/Core and Builtins/2019-12-21-14-18-32.bpo-39091.dOexgQ.rst
@@ -0,0 +1 @@
+Fix crash when using passing a non-exception to a generator's ``throw()`` method. Patch by Noah Oxer
diff --git a/Python/errors.c b/Python/errors.c
@@ -85,17 +85,29 @@ _PyErr_GetTopmostException(PyThreadState *tstate)
 }
 
 static PyObject*
-_PyErr_CreateException(PyObject *exception, PyObject *value)
+_PyErr_CreateException(PyObject *exception_type, PyObject *value)
 {
+    PyObject *exc;
+
     if (value == NULL || value == Py_None) {
-        return _PyObject_CallNoArg(exception);
+        exc = _PyObject_CallNoArg(exception_type);
     }
     else if (PyTuple_Check(value)) {
-        return PyObject_Call(exception, value, NULL);
+        exc = PyObject_Call(exception_type, value, NULL);
     }
     else {
-        return PyObject_CallOneArg(exception, value);
+        exc = PyObject_CallOneArg(exception_type, value);
+    }
+
+    if (exc != NULL && !PyExceptionInstance_Check(exc)) {
+        PyErr_Format(PyExc_TypeError,
+                     "calling %R should have returned an instance of "
+                     "BaseException, not %s",
+                     exception_type, Py_TYPE(exc)->tp_name);
+        Py_CLEAR(exc);
     }
+
+    return exc;
 }
 
 void

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	+Fix crash when using passing a non-exception to a generator's ``throw()`` method. Patch by Noah Oxer
Original file line number	Diff line number	Diff line change
`@@ -85,17 +85,29 @@ _PyErr_GetTopmostException(PyThreadState *tstate)`
`85`	`85`	`}`
`86`	`86`
`87`	`87`	`static PyObject*`
`88`		`-_PyErr_CreateException(PyObject exception, PyObject value)`
	`88`	`+_PyErr_CreateException(PyObject exception_type, PyObject value)`
`89`	`89`	`{`
	`90`	`+ PyObject *exc;`
	`91`	`+`
`90`	`92`	`if (value == NULL \|\| value == Py_None) {`
`91`		`- return _PyObject_CallNoArg(exception);`
	`93`	`+ exc = _PyObject_CallNoArg(exception_type);`
`92`	`94`	`}`
`93`	`95`	`else if (PyTuple_Check(value)) {`
`94`		`- return PyObject_Call(exception, value, NULL);`
	`96`	`+ exc = PyObject_Call(exception_type, value, NULL);`
`95`	`97`	`}`
`96`	`98`	`else {`
`97`		`- return PyObject_CallOneArg(exception, value);`
	`99`	`+ exc = PyObject_CallOneArg(exception_type, value);`
	`100`	`+ }`
	`101`	`+`
	`102`	`+ if (exc != NULL && !PyExceptionInstance_Check(exc)) {`
	`103`	`+ PyErr_Format(PyExc_TypeError,`
	`104`	`+ "calling %R should have returned an instance of "`
	`105`	`+ "BaseException, not %s",`
	`106`	`+ exception_type, Py_TYPE(exc)->tp_name);`
	`107`	`+ Py_CLEAR(exc);`
`98`	`108`	`}`
	`109`	`+`
	`110`	`+ return exc;`
`99`	`111`	`}`
`100`	`112`
`101`	`113`	`void`