Repository navigation
segfault in property.getter/setter/deleter if property subclass has weird __new__ #100942
Description
CPython crashes if run on the following code:
class pro(property):
def __new__(typ, *args, **kwargs):
return "abcdef"
class A:
pass
p = property.__new__(pro)
p.__set_name__(A, 1)
np = p.getter(lambda self: 1)The crash happens on the last line. The problem is the following code in property_copy:
new = PyObject_CallFunctionObjArgs(type, get, set, del, doc, NULL);
Py_DECREF(type);
if (new == NULL)
return NULL;
Py_XSETREF(((propertyobject *) new)->prop_name, Py_XNewRef(pold->prop_name));
return new;In the crashing code, new is a string, so casting it to propertyobject and writing to prop_name is wrong.
This is synthetic code, I found the problem while porting some 3.10 features to PyPy and thinking about corner cases.
Activity
mdboom commentedon Jan 11, 2023
Confirmed on 3.10, 3.11 and main.
pythongh-100942: Fix crash on `property` subtypes with weird `__new__`
sobolevn commentedon Jan 11, 2023
__set_name__part is not required for the repro:This code also crashes on 3.12
rhettinger commentedon Jan 11, 2023
This did not fail on 3.9. Soonish, I will hunt down the offending check in. Off hand, I suspect the disasterous and now deprecated descriptor chaining logic.
sobolevn commentedon Jan 11, 2023
Commit that introduced these lines: c56387f
rhettinger commentedon Jan 12, 2023
Confirmed, c56387f is the culprit.
pythonGH-100942: Fix incorrect cast in property_copy().
GH-100942: Fix incorrect cast in property_copy(). (#100965)
[3.11] pythonGH-100942: Fix incorrect cast in property_copy(). (pytho…
[3.10] pythonGH-100942: Fix incorrect cast in property_copy(). (pytho…
rhettinger commentedon Jan 14, 2023
@sobolevn Thank you for the back ports.
[3.11] GH-100942: Fix incorrect cast in property_copy(). (GH-100965). (…
[3.10] GH-100942: Fix incorrect cast in property_copy(). (GH-100965). (…