From: Mark Dickinson <dickinsm@gmail.com>
Date: Sun, 3 Mar 2013 11:13:34 +0000 (+0000)
Subject: Issue #16445: Fix potential segmentation fault when deleting an exception message.
X-Git-Tag: v2.7.4rc1~64^2~3
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7cac1c25a144a5d17353a245cec39198dc0b5d21;p=thirdparty%2FPython%2Fcpython.git

Issue #16445: Fix potential segmentation fault when deleting an exception message.
---

diff --git a/Lib/test/test_exceptions.py b/Lib/test/test_exceptions.py
index 216064161cb3..a485cba893c0 100644
--- a/Lib/test/test_exceptions.py
+++ b/Lib/test/test_exceptions.py
@@ -479,6 +479,18 @@ class ExceptionTests(unittest.TestCase):
         except AssertionError as e:
             self.assertEqual(str(e), "(3,)")
 
+    def test_bad_exception_clearing(self):
+        # See issue 16445: use of Py_XDECREF instead of Py_CLEAR in
+        # BaseException_set_message gave a possible way to segfault the
+        # interpreter.
+        class Nasty(str):
+            def __del__(message):
+                del e.message
+
+        e = ValueError(Nasty("msg"))
+        e.args = ()
+        del e.message
+
 
 # Helper class used by TestSameStrAndUnicodeMsg
 class ExcWithOverriddenStr(Exception):
diff --git a/Misc/NEWS b/Misc/NEWS
index 78d52f0db7d4..4f6fdca3aa8a 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -9,6 +9,9 @@ What's New in Python 2.7.4
 Core and Builtins
 -----------------
 
+- Issue #16445: Fixed potential segmentation fault when deleting an exception
+  message.
+
 - Issue #17275: Corrected class name in init error messages of the C version of
   BufferedWriter and BufferedRandom.
 
diff --git a/Objects/exceptions.c b/Objects/exceptions.c
index 49f6d30cd3c9..0f86cfb19423 100644
--- a/Objects/exceptions.c
+++ b/Objects/exceptions.c
@@ -349,8 +349,7 @@ BaseException_set_message(PyBaseExceptionObject *self, PyObject *val)
             if (PyDict_DelItemString(self->dict, "message") < 0)
                 return -1;
         }
-        Py_XDECREF(self->message);
-        self->message = NULL;
+        Py_CLEAR(self->message);
         return 0;
     }