Skip to content

Commit

Permalink
Fix segfault in yajl2_c's parse_basecoro
Browse files Browse the repository at this point in the history
This problem was caused by calling Py_DECREF() more than once on the
static, global PyObject* "item" variable that we use to keep the "item"
string literal in memory. The situation only arouse when the top-level
JSON value was an array, and therefore did not hit all users
necessarily.

More than one of our tests use arrays as their top-level JSON values
that went through parse_basecoro, so in principle we should have hit the
bug, but it still went unnoticed. This might have been just luck, with
the python memory allocator playing in our favor and placing valid
objects back into the memory previously used by the "item" variable
before we decreased its reference count again. In order to reproduce the
error more reliably more tests need to be added to try and hit the
problem with a higher chance.

This problem was originally reported in #29, and was a direct
consequence of the fix introduced to fix #28.

Signed-off-by: Rodrigo Tobar <rtobar@icrar.org>
  • Loading branch information
rtobar committed Apr 23, 2020
1 parent ddc6954 commit ee98d13
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions ijson/backends/yajl2_c/parse_basecoro.c
Original file line number Diff line number Diff line change
Expand Up @@ -90,16 +90,16 @@ PyObject* parse_basecoro_send_impl(PyObject *self, PyObject *event, PyObject *va
PyObject *last_path;
N_N(last_path = PySequence_GetItem(gen->path, npaths - 1));

PyObject *new_path;
if (PyUnicode_GET_SIZE(last_path) > 0) {
PyObject *new_path;
CONCAT(new_path, last_path, dotitem);
N_M1(PyList_Append(gen->path, new_path));
Py_DECREF(new_path);
}
else {
new_path = item;
N_M1(PyList_Append(gen->path, item));
Py_DECREF(last_path);
}
N_M1(PyList_Append(gen->path, new_path));
Py_DECREF(new_path);
}
else if (event == enames.start_map_ename) {
Py_INCREF(Py_None);
Expand Down

0 comments on commit ee98d13

Please sign in to comment.