Backport of rev 2.199 from trunk.

PyObject_Generic{Get,Set}Attr:

Don't access tp_descr_{get,set} of a descriptor without checking the
flag bits of the descriptor's type.  While we know that the main type
(the type of the object whose attribute is being accessed) has all the
right flag bits (or else PyObject_Generic{Get,Set}Attr wouldn't be
called), we don't know that for its class attributes!

diff --git a/Objects/object.c b/Objects/object.c
index 893be733cac7eea025d0ca026c6f55272df7b9f1..673af1fedea7ac925cd5a8cdf30fa952241331af 100644 (file)
--- a/Objects/object.c
+++ b/Objects/object.c
@@ -1259,7 +1259,8 @@ PyObject_GenericGetAttr(PyObject *obj, PyObject *name)
 
        descr = _PyType_Lookup(tp, name);
        f = NULL;
-       if (descr != NULL) {
+       if (descr != NULL &&
+           PyType_HasFeature(descr->ob_type, Py_TPFLAGS_HAVE_CLASS)) {
                f = descr->ob_type->tp_descr_get;
                if (f != NULL && PyDescr_IsData(descr)) {
                        res = f(descr, obj, (PyObject *)obj->ob_type);
@@ -1333,7 +1334,8 @@ PyObject_GenericSetAttr(PyObject *obj, PyObject *name, PyObject *value)
 
        descr = _PyType_Lookup(tp, name);
        f = NULL;
-       if (descr != NULL) {
+       if (descr != NULL &&
+           PyType_HasFeature(descr->ob_type, Py_TPFLAGS_HAVE_CLASS)) {
                f = descr->ob_type->tp_descr_set;
                if (f != NULL && PyDescr_IsData(descr)) {
                        res = f(descr, obj, value);