Fix for

Michael W. Hudson · Michael W. Hudson · commit b2c7de46673e · 2003-08-15T13:07:47.000Z
[ 784825 ] fix obscure crash in descriptor handling

Should be applied to release23-maint and in all likelyhood
release22-maint, too.

Certainly doesn't apply to release21-maint.
diff --git a/Lib/test/test_descr.py b/Lib/test/test_descr.py
@@ -3938,6 +3938,36 @@ def __getattr__(self, attr):
     except RuntimeError:
         pass
 
+def vicious_descriptor_nonsense():
+    # A potential segfault spotted by Thomas Wouters in mail to
+    # python-dev 2003-04-17, turned into an example & fixed by Michael
+    # Hudson just less than four months later...
+    if verbose:
+        print "Testing vicious_descriptor_nonsense..."
+
+    class Evil(object):
+        def __hash__(self):
+            return hash('attr')
+        def __eq__(self, other):
+            del C.attr
+            return 0
+
+    class Descr(object):
+        def __get__(self, ob, type=None):
+            return 1
+
+    class C(object):
+        attr = Descr()
+
+    c = C()
+    c.__dict__[Evil()] = 0
+
+    vereq(c.attr, 1)
+    # this makes a crash more likely:
+    import gc; gc.collect()
+    vereq(hasattr(c, 'attr'), False)
+    
+
 def test_main():
     weakref_segfault() # Must be first, somehow
     do_this_first()
@@ -4029,6 +4059,7 @@ def test_main():
     proxysuper()
     carloverre()
     filefault()
+    vicious_descriptor_nonsense()
 
     if verbose: print "All OK"
 
diff --git a/Objects/object.c b/Objects/object.c
@@ -1412,12 +1412,15 @@ PyObject_GenericGetAttr(PyObject *obj, PyObject *name)
 		}
 	}
 
+	Py_XINCREF(descr);
+
 	f = NULL;
 	if (descr != NULL &&
 	    PyType_HasFeature(descr->ob_type, Py_TPFLAGS_HAVE_CLASS)) {
 		f = descr->ob_type->tp_descr_get;
 		if (f != NULL && PyDescr_IsData(descr)) {
 			res = f(descr, obj, (PyObject *)obj->ob_type);
+			Py_DECREF(descr);
 			goto done;
 		}
 	}
@@ -1445,19 +1448,21 @@ PyObject_GenericGetAttr(PyObject *obj, PyObject *name)
 			res = PyDict_GetItem(dict, name);
 			if (res != NULL) {
 				Py_INCREF(res);
+				Py_XDECREF(descr);
 				goto done;
 			}
 		}
 	}
 
 	if (f != NULL) {
 		res = f(descr, obj, (PyObject *)obj->ob_type);
+		Py_DECREF(descr);
 		goto done;
 	}
 
 	if (descr != NULL) {
-		Py_INCREF(descr);
 		res = descr;
+		/* descr was already increfed above */
 		goto done;
 	}
 
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
@@ -2010,6 +2010,7 @@ type_getattro(PyTypeObject *type, PyObject *name)
 			return meta_get(meta_attribute, (PyObject *)type,
 					(PyObject *)metatype);
 		}
+		Py_INCREF(meta_attribute);
 	}
 
 	/* No data descriptor found on metatype. Look in tp_dict of this
@@ -2018,6 +2019,9 @@ type_getattro(PyTypeObject *type, PyObject *name)
 	if (attribute != NULL) {
 		/* Implement descriptor functionality, if any */
 		descrgetfunc local_get = attribute->ob_type->tp_descr_get;
+
+		Py_XDECREF(meta_attribute);
+
 		if (local_get != NULL) {
 			/* NULL 2nd argument indicates the descriptor was
 			 * found on the target object itself (or a base)  */
@@ -2031,13 +2035,16 @@ type_getattro(PyTypeObject *type, PyObject *name)
 
 	/* No attribute found in local __dict__ (or bases): use the
 	 * descriptor from the metatype, if any */
-	if (meta_get != NULL)
-		return meta_get(meta_attribute, (PyObject *)type,
-				(PyObject *)metatype);
+	if (meta_get != NULL) {
+		PyObject *res;
+		res = meta_get(meta_attribute, (PyObject *)type,
+			       (PyObject *)metatype);
+		Py_DECREF(meta_attribute);
+		return res;
+	}
 
 	/* If an ordinary attribute was found on the metatype, return it now */
 	if (meta_attribute != NULL) {
-		Py_INCREF(meta_attribute);
 		return meta_attribute;
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -1412,12 +1412,15 @@ PyObject_GenericGetAttr(PyObject obj, PyObject name)`
`1412`	`1412`	`}`
`1413`	`1413`	`}`
`1414`	`1414`
	`1415`	`+ Py_XINCREF(descr);`
	`1416`	`+`
`1415`	`1417`	`f = NULL;`
`1416`	`1418`	`if (descr != NULL &&`
`1417`	`1419`	`PyType_HasFeature(descr->ob_type, Py_TPFLAGS_HAVE_CLASS)) {`
`1418`	`1420`	`f = descr->ob_type->tp_descr_get;`
`1419`	`1421`	`if (f != NULL && PyDescr_IsData(descr)) {`
`1420`	`1422`	`res = f(descr, obj, (PyObject *)obj->ob_type);`
	`1423`	`+ Py_DECREF(descr);`
`1421`	`1424`	`goto done;`
`1422`	`1425`	`}`
`1423`	`1426`	`}`
`@@ -1445,19 +1448,21 @@ PyObject_GenericGetAttr(PyObject obj, PyObject name)`
`1445`	`1448`	`res = PyDict_GetItem(dict, name);`
`1446`	`1449`	`if (res != NULL) {`
`1447`	`1450`	`Py_INCREF(res);`
	`1451`	`+ Py_XDECREF(descr);`
`1448`	`1452`	`goto done;`
`1449`	`1453`	`}`
`1450`	`1454`	`}`
`1451`	`1455`	`}`
`1452`	`1456`
`1453`	`1457`	`if (f != NULL) {`
`1454`	`1458`	`res = f(descr, obj, (PyObject *)obj->ob_type);`
	`1459`	`+ Py_DECREF(descr);`
`1455`	`1460`	`goto done;`
`1456`	`1461`	`}`
`1457`	`1462`
`1458`	`1463`	`if (descr != NULL) {`
`1459`		`- Py_INCREF(descr);`
`1460`	`1464`	`res = descr;`
	`1465`	`+ /* descr was already increfed above */`
`1461`	`1466`	`goto done;`
`1462`	`1467`	`}`
`1463`	`1468`