mirror of
https://github.com/python/cpython.git
synced 2026-10-28 10:25:05 +08:00
gh-159739: Keep generic alias arguments alive while formatting errors (#159981)
When a generic alias contains a list of parameters and an object claiming to be an unpacked type-variable tuple returns a non-tuple from `__typing_subst__`, the error path frees the temporary argument tuple before reading it to format a `TypeError`. That use-after-free can crash the interpreter instead of reporting the invalid substitution.
This commit is contained in:
1 parent
ebce4b70bf
commit
9c649dbaa8
2 files changed
+4
-3
No files matched your search
@@ -0,0 +1 @@
|
||||
Fix a crash when constructing an error for invalid generic alias arguments.
|
||||
@@ -550,13 +550,13 @@ _Py_subs_parameters(PyObject *self, PyObject *args, PyObject *parameters, PyObje
|
||||
}
|
||||
if (unpack) {
|
||||
if (!PyTuple_Check(arg)) {
|
||||
Py_DECREF(newargs);
|
||||
Py_DECREF(item);
|
||||
Py_XDECREF(tuple_args);
|
||||
PyObject *original = PyTuple_GET_ITEM(args, iarg);
|
||||
PyErr_Format(PyExc_TypeError,
|
||||
"expected __typing_subst__ of %T objects to return a tuple, not %T",
|
||||
original, arg);
|
||||
Py_DECREF(newargs);
|
||||
Py_DECREF(item);
|
||||
Py_XDECREF(tuple_args);
|
||||
Py_DECREF(arg);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
Reference in new issue
Block a user