Segmentation fault on timezone comparison

[lanhel]

BPO	15973
Nosy	@birkenfeld, @jcea, @ronaldoussoren, @abalkin, @vstinner, @benjaminp, @bitdancer, @skrah, @jftuga
Files	CoreDump.txt: MacOS X crash log issue15973.diff

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/birkenfeld'
closed_at = <Date 2012-09-22.07:23:21.011>
created_at = <Date 2012-09-19.18:03:16.796>
labels = ['extension-modules', 'type-crash']
title = 'Segmentation fault on timezone comparison'
updated_at = <Date 2012-09-24.05:46:49.652>
user = 'https://bugs.python.org/lanhel'

bugs.python.org fields:

activity = <Date 2012-09-24.05:46:49.652>
actor = 'python-dev'
assignee = 'georg.brandl'
closed = True
closed_date = <Date 2012-09-22.07:23:21.011>
closer = 'georg.brandl'
components = ['Extension Modules']
creation = <Date 2012-09-19.18:03:16.796>
creator = 'lanhel'
dependencies = []
files = ['27224', '27234']
hgrepos = []
issue_num = 15973
keywords = ['patch']
message_count = 21.0
messages = ['170732', '170734', '170736', '170741', '170756', '170757', '170780', '170781', '170783', '170784', '170803', '170815', '170833', '170848', '170849', '170851', '170852', '170959', '170962', '170963', '171099']
nosy_count = 11.0
nosy_names = ['georg.brandl', 'jcea', 'ronaldoussoren', 'belopolsky', 'vstinner', 'benjamin.peterson', 'r.david.murray', 'skrah', 'python-dev', 'jftuga', 'lanhel']
pr_nums = []
priority = 'high'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue15973'
versions = ['Python 3.2', 'Python 3.3']

[lanhel]

In the 3.2.3 interpreter execute the following line:
None == datetime.timezone(datetime.timedelta())
The interpreter will crash with a Segmentation fault: 11.

[skrah]

Reproducible also on Linux with Python 3.3.

[jftuga]

Crashes Python 3.2.3 and Python 3.3.0rc2 on Windows 7 as well.

[abalkin]

I cannot reproduce on a Mac with py3k tip.

Python 3.3.0rc2+ (default:19c74cadea95, Sep 19 2012, 14:39:07) 
[GCC 4.2.1 Compatible Apple Clang 3.1 (tags/Apple/clang-318.0.61)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import datetime
>>> None == datetime.timezone(datetime.timedelta())
False

Can anyone reproduce in a debug build and post a stack trace?

[skrah]

The segfault does not occur in a debug build. The stack trace
suggests that timezone_richcompare() accesses other->offset
of the None object:

(gdb) f 2
#2 0x000000000041d4e9 in do_richcompare (v=None, w=<datetime.timezone at remote 0x7ffff6688ab0>,
op=<value optimized out>) at Objects/object.c:563
563 res = (*f)(w, v, _Py_SwappedOp[op]);
(gdb) f 1
#1 timezone_richcompare (self=0x7ffff6688ab0, other=<value optimized out>, op=2)
at /home/stefan/pydev/cpython-commit/Modules/_datetimemodule.c:3218
3218 return delta_richcompare(self->offset, other->offset, op);
(gdb) l
3213 timezone_richcompare(PyDateTime_TimeZone *self,
3214 PyDateTime_TimeZone *other, int op)
3215 {
3216 if (op != Py_EQ && op != Py_NE)
3217 Py_RETURN_NOTIMPLEMENTED;
3218 return delta_richcompare(self->offset, other->offset, op);
3219 }
3220
3221 static Py_hash_t
3222 timezone_hash(PyDateTime_TimeZone *self)
(gdb) f 0
#0 0x00007ffff5d850cf in delta_richcompare (self=0x7ffff6688ab0, other=<value optimized out>, op=2)
at /home/stefan/pydev/cpython-commit/Modules/_datetimemodule.c:1823
1823 if (PyDelta_Check(other)) {

[bitdancer]

On linux it segfaults for me in the debug interpreter. On default tip.

[abalkin]

I think the following simple patch should do the trick. I'll add some tests and commit. Should this get in 3.3.0?

diff -r 19c74cadea95 Modules/_datetimemodule.c
--- a/Modules/_datetimemodule.c	Wed Sep 19 08:25:01 2012 +0300
+++ b/Modules/_datetimemodule.c	Wed Sep 19 21:42:51 2012 -0400
@@ -3215,6 +3215,11 @@
 {
     if (op != Py_EQ && op != Py_NE)
         Py_RETURN_NOTIMPLEMENTED;
+    if (Py_TYPE(other) != &PyDateTime_TimeZoneType)
+	if (op == Py_EQ)
+	    Py_RETURN_FALSE;
+	else
+	    Py_RETURN_TRUE;
     return delta_richcompare(self->offset, other->offset, op);
 }

[benjaminp]

Hopefully, there will be some more braces, though. :)