From: Antoine Pitrou <solipsis@pitrou.net>
Date: Sun, 11 Oct 2009 21:03:26 +0000 (+0000)
Subject: Issue #7084: Fix a (very unlikely) crash when printing a list from one
X-Git-Tag: v2.7a1~373
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=beaf6a02f45fe667ddcb1fbdd24f1ea7189b2105;p=thirdparty%2FPython%2Fcpython.git

Issue #7084: Fix a (very unlikely) crash when printing a list from one
thread, and mutating it from another one.  Patch by Scott Dial.
---

diff --git a/Misc/ACKS b/Misc/ACKS
index 6383a46a3abe..c8f80e6c2435 100644
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -175,6 +175,7 @@ Arnaud Delobelle
 Erik Demaine
 Roger Dev
 Raghuram Devarakonda
+Scott Dial
 Toby Dickenson
 Mark Dickinson
 Jack Diederich
diff --git a/Misc/NEWS b/Misc/NEWS
index 42a8cd9ba77a..9fc3edc350f1 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,9 @@ What's New in Python 2.7 alpha 1
 Core and Builtins
 -----------------
 
+- Issue #7084: Fix a (very unlikely) crash when printing a list from one
+  thread, and mutating it from another one.  Patch by Scott Dial.
+
 - Issue #1571184: The Unicode database contains properties for more characters.
   The tables for code points representing numeric values, white spaces or line
   breaks are now generated from the official Unicode Character Database files,
diff --git a/Objects/listobject.c b/Objects/listobject.c
index 98d7e473549e..c5b147580292 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -319,6 +319,7 @@ list_print(PyListObject *op, FILE *fp, int flags)
 {
 	int rc;
 	Py_ssize_t i;
+	PyObject *item;
 
 	rc = Py_ReprEnter((PyObject*)op);
 	if (rc != 0) {
@@ -333,15 +334,19 @@ list_print(PyListObject *op, FILE *fp, int flags)
 	fprintf(fp, "[");
 	Py_END_ALLOW_THREADS
 	for (i = 0; i < Py_SIZE(op); i++) {
+		item = op->ob_item[i];
+		Py_INCREF(item);
 		if (i > 0) {
 			Py_BEGIN_ALLOW_THREADS
 			fprintf(fp, ", ");
 			Py_END_ALLOW_THREADS
 		}
-		if (PyObject_Print(op->ob_item[i], fp, 0) != 0) {
+		if (PyObject_Print(item, fp, 0) != 0) {
+			Py_DECREF(item);
 			Py_ReprLeave((PyObject *)op);
 			return -1;
 		}
+		Py_DECREF(item);
 	}
 	Py_BEGIN_ALLOW_THREADS
 	fprintf(fp, "]");