gh-134119: Fix crash from calling next() on exhausted template iterator #134120
Conversation
JelleZijlstra
commented
May 17, 2025
•
- Issue: Segfault from template string iterator #134119
Misc/NEWS.d/next/Core_and_Builtins/2025-05-16-20-59-12.gh-issue-134119.w8expI.rst
Outdated
Show resolved
Hide resolved
| @@ -23,6 +23,9 @@ templateiter_next(PyObject *op) | |||
| if (self->from_strings) { | |||
| item = PyIter_Next(self->stringsiter); | |||
| self->from_strings = 0; | |||
| if (item == NULL) { | |||
| return NULL; | |||
| } | |||
| if (PyUnicode_GET_LENGTH(item) == 0) { | |||
There was a problem hiding this comment.
Maybe it is worth to add condition here like
if (!item || PyUnicode_GET_LENGTH(item) == 0) {
Py_XSETREF(item, PyItem_Next(self->interpolationsiter));
self->from_strings = 1;
}
There was a problem hiding this comment.
I think that would potentially make an API call with an exception set, which is not allowed, right?
There was a problem hiding this comment.
Yeah, good point. Thanks!
| @@ -23,6 +23,9 @@ templateiter_next(PyObject *op) | |||
| if (self->from_strings) { | |||
| item = PyIter_Next(self->stringsiter); | |||
| self->from_strings = 0; | |||
| if (item == NULL) { | |||
| return NULL; | |||
| } | |||
| if (PyUnicode_GET_LENGTH(item) == 0) { | |||
| Py_SETREF(item, PyIter_Next(self->interpolationsiter)); | |||
There was a problem hiding this comment.
Should the result of PyIter_Next(self->interpolationsiter) be checked for NULL too?
There was a problem hiding this comment.
That case just falls through to returning NULL safely, so it's probably fine as-is.
(The fall-through is intentional: since there is always one more string than interpolation, the first NULL returned by the iterator will always be here.)
There was a problem hiding this comment.
Py_SETREF is safe if it assigns to NULL, the behavior should be correct in that case.
There was a problem hiding this comment.
Looks good to me as soon as @picnixz's feedback has been addressed.
Co-authored-by: Bénédikt Tran <[email protected]>
|
Thanks @JelleZijlstra for the PR 🌮🎉.. I'm working now to backport this PR to: 3.14. |
…iterator (pythonGH-134120) (cherry picked from commit fc7f4c3) Co-authored-by: Jelle Zijlstra <[email protected]> Co-authored-by: Bénédikt Tran <[email protected]>
|
GH-134153 is a backport of this pull request to the 3.14 branch. |
… iterator (GH-134120) (#134153) gh-134119: Fix crash from calling next() on exhausted template iterator (GH-134120) (cherry picked from commit fc7f4c3) Co-authored-by: Jelle Zijlstra <[email protected]> Co-authored-by: Bénédikt Tran <[email protected]>