Issue #24257: Fixed incorrect uses of PyObject_IsInstance().

serhiy-storchaka · serhiy-storchaka · commit 08d230a5408e · 2015-05-22T11:02:49.000+03:00
Fixed segmentation fault in sqlite3.Row constructor with faked cursor type.
Fixed system error in the comparison of faked types.SimpleNamespace.
diff --git a/Lib/sqlite3/test/factory.py b/Lib/sqlite3/test/factory.py
@@ -162,6 +162,14 @@ def CheckSqliteRowAsSequence(self):
         self.assertEqual(list(reversed(row)), list(reversed(as_tuple)))
         self.assertIsInstance(row, Sequence)
 
+    def CheckFakeCursorClass(self):
+        # Issue #24257: Incorrect use of PyObject_IsInstance() caused
+        # segmentation fault.
+        class FakeCursor(str):
+            __class__ = sqlite.Cursor
+        cur = self.con.cursor(factory=FakeCursor)
+        self.assertRaises(TypeError, sqlite.Row, cur, ())
+
     def tearDown(self):
         self.con.close()
 
diff --git a/Lib/test/test_types.py b/Lib/test/test_types.py
@@ -1169,6 +1169,22 @@ def test_pickle(self):
 
             self.assertEqual(ns, ns_roundtrip, pname)
 
+    def test_fake_namespace_compare(self):
+        # Issue #24257: Incorrect use of PyObject_IsInstance() caused
+        # SystemError.
+        class FakeSimpleNamespace(str):
+            __class__ = types.SimpleNamespace
+        self.assertFalse(types.SimpleNamespace() == FakeSimpleNamespace())
+        self.assertTrue(types.SimpleNamespace() != FakeSimpleNamespace())
+        with self.assertRaises(TypeError):
+            types.SimpleNamespace() < FakeSimpleNamespace()
+        with self.assertRaises(TypeError):
+            types.SimpleNamespace() <= FakeSimpleNamespace()
+        with self.assertRaises(TypeError):
+            types.SimpleNamespace() > FakeSimpleNamespace()
+        with self.assertRaises(TypeError):
+            types.SimpleNamespace() >= FakeSimpleNamespace()
+
 
 def test_main():
     run_unittest(TypesTests, MappingProxyTests, ClassCreationTests,
diff --git a/Misc/NEWS b/Misc/NEWS
@@ -10,6 +10,9 @@ Release date: tba
 Core and Builtins
 -----------------
 
+- Issue #24257: Fixed system error in the comparison of faked
+  types.SimpleNamespace.
+
 - Issue #22939: Fixed integer overflow in iterator object.  Patch by
   Clement Rouault.
 
@@ -56,6 +59,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #24257: Fixed segmentation fault in sqlite3.Row constructor with faked
+  cursor type.
+
 - Issue #22107: tempfile.gettempdir() and tempfile.mkdtemp() now try again
   when a directory with the chosen name already exists on Windows as well as
   on Unix.  tempfile.mkstemp() now fails early if parent directory is not
diff --git a/Modules/_sqlite/row.c b/Modules/_sqlite/row.c
@@ -46,7 +46,7 @@ pysqlite_row_new(PyTypeObject *type, PyObject *args, PyObject *kwargs)
     if (!PyArg_ParseTuple(args, "OO", &cursor, &data))
         return NULL;
 
-    if (!PyObject_IsInstance((PyObject*)cursor, (PyObject*)&pysqlite_CursorType)) {
+    if (!PyObject_TypeCheck((PyObject*)cursor, &pysqlite_CursorType)) {
         PyErr_SetString(PyExc_TypeError, "instance of cursor required for first argument");
         return NULL;
     }
diff --git a/Objects/genobject.c b/Objects/genobject.c
@@ -398,8 +398,7 @@ _PyGen_FetchStopIterationValue(PyObject **pvalue) {
         PyErr_Fetch(&et, &ev, &tb);
         if (ev) {
             /* exception will usually be normalised already */
-            if (Py_TYPE(ev) == (PyTypeObject *) et
-                || PyObject_IsInstance(ev, PyExc_StopIteration)) {
+            if (PyObject_TypeCheck(ev, (PyTypeObject *) et)) {
                 value = ((PyStopIterationObject *)ev)->value;
                 Py_INCREF(value);
                 Py_DECREF(ev);
@@ -409,7 +408,7 @@ _PyGen_FetchStopIterationValue(PyObject **pvalue) {
             } else {
                 /* normalisation required */
                 PyErr_NormalizeException(&et, &ev, &tb);
-                if (!PyObject_IsInstance(ev, PyExc_StopIteration)) {
+                if (!PyObject_TypeCheck(ev, (PyTypeObject *)PyExc_StopIteration)) {
                     PyErr_Restore(et, ev, tb);
                     return -1;
                 }
diff --git a/Objects/namespaceobject.c b/Objects/namespaceobject.c
@@ -164,12 +164,11 @@ namespace_clear(_PyNamespaceObject *ns)
 static PyObject *
 namespace_richcompare(PyObject *self, PyObject *other, int op)
 {
-    if (PyObject_IsInstance(self, (PyObject *)&_PyNamespace_Type) &&
-            PyObject_IsInstance(other, (PyObject *)&_PyNamespace_Type))
+    if (PyObject_TypeCheck(self, &_PyNamespace_Type) &&
+        PyObject_TypeCheck(other, &_PyNamespace_Type))
         return PyObject_RichCompare(((_PyNamespaceObject *)self)->ns_dict,
                                    ((_PyNamespaceObject *)other)->ns_dict, op);
-    Py_INCREF(Py_NotImplemented);
-    return Py_NotImplemented;
+    Py_RETURN_NOTIMPLEMENTED;
 }
 
 

Original file line number	Diff line number	Diff line change
`@@ -46,7 +46,7 @@ pysqlite_row_new(PyTypeObject type, PyObject args, PyObject *kwargs)`
`46`	`46`	`if (!PyArg_ParseTuple(args, "OO", &cursor, &data))`
`47`	`47`	`return NULL;`
`48`	`48`
`49`		`- if (!PyObject_IsInstance((PyObject)cursor, (PyObject)&pysqlite_CursorType)) {`
	`49`	`+ if (!PyObject_TypeCheck((PyObject*)cursor, &pysqlite_CursorType)) {`
`50`	`50`	`PyErr_SetString(PyExc_TypeError, "instance of cursor required for first argument");`
`51`	`51`	`return NULL;`
`52`	`52`	`}`
Original file line number	Diff line number	Diff line change
`@@ -164,12 +164,11 @@ namespace_clear(_PyNamespaceObject *ns)`
`164`	`164`	`static PyObject *`
`165`	`165`	`namespace_richcompare(PyObject self, PyObject other, int op)`
`166`	`166`	`{`
`167`		`- if (PyObject_IsInstance(self, (PyObject *)&_PyNamespace_Type) &&`
`168`		`- PyObject_IsInstance(other, (PyObject *)&_PyNamespace_Type))`
	`167`	`+ if (PyObject_TypeCheck(self, &_PyNamespace_Type) &&`
	`168`	`+ PyObject_TypeCheck(other, &_PyNamespace_Type))`
`169`	`169`	`return PyObject_RichCompare(((_PyNamespaceObject *)self)->ns_dict,`
`170`	`170`	`((_PyNamespaceObject *)other)->ns_dict, op);`
`171`		`- Py_INCREF(Py_NotImplemented);`
`172`		`- return Py_NotImplemented;`
	`171`	`+ Py_RETURN_NOTIMPLEMENTED;`
`173`	`172`	`}`
`174`	`173`
`175`	`174`