Backport:

Fix for rather inaccurately titled bug

[ 1165306 ] Property access with decorator makes interpreter crash

Don't allow the creation of unbound methods with NULL im_class, because
attempting to call such crashes.

Backport candidate.

diff --git a/Lib/test/test_new.py b/Lib/test/test_new.py
index f022f7e843fb85ac6905d55efeebcadf2ba4442a..4aab1e268b06f64abd23796ec397847be448cbab 100644 (file)
--- a/Lib/test/test_new.py
+++ b/Lib/test/test_new.py
@@ -47,6 +47,16 @@ im()
 verify(c.get_yolks() == 1 and c.get_more_yolks() == 4,
        'Broken call of hand-crafted instance method')
 
+im = new.instancemethod(break_yolks, c)
+im()
+verify(c.get_yolks() == -1)
+try:
+    new.instancemethod(break_yolks, None)
+except TypeError:
+    pass
+else:
+    raise TestFailed, "dangerous instance method creation allowed"
+
 # It's unclear what the semantics should be for a code object compiled at
 # module scope, but bound and run in a function.  In CPython, `c' is global
 # (by accident?) while in Jython, `c' is local.  The intent of the test

diff --git a/Objects/classobject.c b/Objects/classobject.c
index 506faab4678965fd7e8e5509280744e63ab181c0..68505f1527bc517d3f7ab920bfb5cf623f3ea370 100644 (file)
--- a/Objects/classobject.c
+++ b/Objects/classobject.c
@@ -2208,6 +2208,12 @@ instancemethod_new(PyTypeObject* type, PyObject* args, PyObject *kw)
        }
        if (self == Py_None)
                self = NULL;
+       if (self == NULL && classObj == NULL) {
+               PyErr_SetString(PyExc_TypeError,
+                       "unbound methods must have non-NULL im_class");
+               return NULL;
+       }
+
        return PyMethod_New(func, self, classObj);
 }