Skip to content

bpo-34113: Fix SIGSEGV on negative STACKADJ when LLTRACE is on #8517

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Jul 31, 2018
Merged

bpo-34113: Fix SIGSEGV on negative STACKADJ when LLTRACE is on #8517

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
739c384
bpo-34113: Fix SIGSEGV on negative STACKADJ when LLTRACE is on
costypetrisor Jul 28, 2018
6f8d632
updated NEWS.d using blurb
costypetrisor Jul 28, 2018
345cbd9
followed review comments by Victor Stinner
costypetrisor Jul 28, 2018
4ee09fb
added a test which fails without the fix in this PR
costypetrisor Jul 28, 2018
0cfc6bd
addressed review comments by Victor Stinner
costypetrisor Jul 31, 2018
5eca161
renamed macros STACKADJ_GROW to STACK_GROW and STACKADJ_SHRINK to STA…
costypetrisor Jul 31, 2018
627d639
used support.TESTFN instead of tempfile.NamedTemporaryFile
costypetrisor Jul 31, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions Lib/test/test_lltrace.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
import os
import textwrap
import unittest

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please remove this empty line

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done :)

from test import support
from test.support.script_helper import assert_python_ok


class TestLLTrace(unittest.TestCase):

def test_lltrace_does_not_crash_on_subscript_operator(self):
# If this test fails, it will reproduce a crash reported as
# bpo-34113. The crash happened at the command line console of
# debug Python builds with __ltrace__ enabled (only possible in console),
# when the interal Python stack was negatively adjusted
with open(support.TESTFN, 'w') as fd:
self.addCleanup(os.unlink, support.TESTFN)
fd.write(textwrap.dedent("""\
import code

console = code.InteractiveConsole()
console.push('__ltrace__ = 1')
console.push('a = [1, 2, 3]')
console.push('a[0] = 1')
print('unreachable if bug exists')
"""))

assert_python_ok(support.TESTFN)

if __name__ == "__main__":
unittest.main()
2 changes: 2 additions & 0 deletions Misc/NEWS.d/next/Core and Builtins/2018-07-28-10-34-00.bpo-34113.eZ5FWV.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
Fixed crash on debug builds when opcode stack was adjusted with negative
numbers. Patch by Constantin Petrisor.
44 changes: 27 additions & 17 deletions Python/ceval.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -762,16 +762,26 @@ _PyEval_EvalFrameDefault(PyFrameObject *f, int throwflag)
assert(STACK_LEVEL() <= co->co_stacksize); }
#define POP() ((void)(lltrace && prtrace(TOP(), "pop")), \
BASIC_POP())
#define STACKADJ(n) { (void)(BASIC_STACKADJ(n), \
#define STACK_GROW(n) do { \
assert(n >= 0); \
(void)(BASIC_STACKADJ(n), \
lltrace && prtrace(TOP(), "stackadj")); \
assert(STACK_LEVEL() <= co->co_stacksize); }
assert(STACK_LEVEL() <= co->co_stacksize); \
} while (0)
#define STACK_SHRINK(n) do { \
assert(n >= 0); \
(void)(lltrace && prtrace(TOP(), "stackadj")); \
(void)(BASIC_STACKADJ(-n)); \
assert(STACK_LEVEL() <= co->co_stacksize); \
} while (0)
#define EXT_POP(STACK_POINTER) ((void)(lltrace && \
prtrace((STACK_POINTER)[-1], "ext_pop")), \
*--(STACK_POINTER))
#else
#define PUSH(v) BASIC_PUSH(v)
#define POP() BASIC_POP()
#define STACKADJ(n) BASIC_STACKADJ(n)
#define STACK_GROW(n) BASIC_STACKADJ(n)
#define STACK_SHRINK(n) BASIC_STACKADJ(-n)
#define EXT_POP(STACK_POINTER) (*--(STACK_POINTER))
#endif

Expand Down Expand Up @@ -1133,7 +1143,7 @@ _PyEval_EvalFrameDefault(PyFrameObject *f, int throwflag)
PyObject *second = SECOND();
Py_INCREF(top);
Py_INCREF(second);
STACKADJ(2);
STACK_GROW(2);
SET_TOP(top);
SET_SECOND(second);
FAST_DISPATCH();
Expand Down Expand Up @@ -1173,7 +1183,7 @@ _PyEval_EvalFrameDefault(PyFrameObject *f, int throwflag)
SET_TOP(Py_False);
DISPATCH();
}
STACKADJ(-1);
STACK_SHRINK(1);
goto error;
}

Expand Down Expand Up @@ -1569,7 +1579,7 @@ _PyEval_EvalFrameDefault(PyFrameObject *f, int throwflag)
PyObject *container = SECOND();
PyObject *v = THIRD();
int err;
STACKADJ(-3);
STACK_SHRINK(3);
/* container[sub] = v */
err = PyObject_SetItem(container, sub, v);
Py_DECREF(v);
Expand All @@ -1584,7 +1594,7 @@ _PyEval_EvalFrameDefault(PyFrameObject *f, int throwflag)
PyObject *sub = TOP();
PyObject *container = SECOND();
int err;
STACKADJ(-2);
STACK_SHRINK(2);
/* del container[sub] */
err = PyObject_DelItem(container, sub);
Py_DECREF(container);
Expand Down Expand Up @@ -2067,7 +2077,7 @@ _PyEval_EvalFrameDefault(PyFrameObject *f, int throwflag)
}
} else if (unpack_iterable(seq, oparg, -1,
stack_pointer + oparg)) {
STACKADJ(oparg);
STACK_GROW(oparg);
} else {
/* unpack_iterable() raised an exception */
Py_DECREF(seq);
Expand Down Expand Up @@ -2097,7 +2107,7 @@ _PyEval_EvalFrameDefault(PyFrameObject *f, int throwflag)
PyObject *owner = TOP();
PyObject *v = SECOND();
int err;
STACKADJ(-2);
STACK_SHRINK(2);
err = PyObject_SetAttr(owner, name, v);
Py_DECREF(v);
Py_DECREF(owner);
Expand Down Expand Up @@ -2420,7 +2430,7 @@ _PyEval_EvalFrameDefault(PyFrameObject *f, int throwflag)
err = PySet_Add(set, item);
Py_DECREF(item);
}
STACKADJ(-oparg);
STACK_SHRINK(oparg);
if (err != 0) {
Py_DECREF(set);
goto error;
Expand Down Expand Up @@ -2641,7 +2651,7 @@ _PyEval_EvalFrameDefault(PyFrameObject *f, int throwflag)
PyObject *value = SECOND();
PyObject *map;
int err;
STACKADJ(-2);
STACK_SHRINK(2);
map = PEEK(oparg); /* dict */
assert(PyDict_CheckExact(map));
err = PyDict_SetItem(map, key, value); /* map[key] = value */
Expand Down Expand Up @@ -2784,7 +2794,7 @@ _PyEval_EvalFrameDefault(PyFrameObject *f, int throwflag)
PyObject *cond = TOP();
int err;
if (cond == Py_True) {
STACKADJ(-1);
STACK_SHRINK(1);
Py_DECREF(cond);
FAST_DISPATCH();
}
Expand All @@ -2794,7 +2804,7 @@ _PyEval_EvalFrameDefault(PyFrameObject *f, int throwflag)
}
err = PyObject_IsTrue(cond);
if (err > 0) {
STACKADJ(-1);
STACK_SHRINK(1);
Py_DECREF(cond);
}
else if (err == 0)
Expand All @@ -2808,7 +2818,7 @@ _PyEval_EvalFrameDefault(PyFrameObject *f, int throwflag)
PyObject *cond = TOP();
int err;
if (cond == Py_False) {
STACKADJ(-1);
STACK_SHRINK(1);
Py_DECREF(cond);
FAST_DISPATCH();
}
Expand All @@ -2821,7 +2831,7 @@ _PyEval_EvalFrameDefault(PyFrameObject *f, int throwflag)
JUMPTO(oparg);
}
else if (err == 0) {
STACKADJ(-1);
STACK_SHRINK(1);
Py_DECREF(cond);
}
else
Expand Down Expand Up @@ -2907,7 +2917,7 @@ _PyEval_EvalFrameDefault(PyFrameObject *f, int throwflag)
PyErr_Clear();
}
/* iterator ended normally */
STACKADJ(-1);
STACK_SHRINK(1);
Py_DECREF(iter);
JUMPBY(oparg);
PREDICT(POP_BLOCK);
Expand Down Expand Up @@ -3015,7 +3025,7 @@ _PyEval_EvalFrameDefault(PyFrameObject *f, int throwflag)
val = tb = Py_None;
exc = TOP();
if (exc == NULL) {
STACKADJ(-1);
STACK_SHRINK(1);
exit_func = TOP();
SET_TOP(exc);
exc = Py_None;
Expand Down