A possible null pointer dereference in _pickle.c's save_reduce()

[ZackerySpytz]

BPO	34987
Nosy	@serhiy-storchaka, @ZackerySpytz, @miss-islington
PRs	bpo-34987: Fix a possible null pointer dereference in _pickle.c's save_reduce() #9886 [3.7] bpo-34987: Fix a possible null pointer dereference in _pickle.c's save_reduce(). (GH-9886) #10932 [3.6] bpo-34987: Fix a possible null pointer dereference in _pickle.c's save_reduce(). (GH-9886) #10933

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2018-12-06.15:06:00.556>
created_at = <Date 2018-10-15.06:44:10.661>
labels = ['extension-modules', '3.7', '3.8', 'type-crash']
title = "A possible null pointer dereference in _pickle.c's save_reduce()"
updated_at = <Date 2018-12-06.15:06:00.555>
user = 'https://github.com/ZackerySpytz'

bugs.python.org fields:

activity = <Date 2018-12-06.15:06:00.555>
actor = 'ZackerySpytz'
assignee = 'none'
closed = True
closed_date = <Date 2018-12-06.15:06:00.556>
closer = 'ZackerySpytz'
components = ['Extension Modules']
creation = <Date 2018-10-15.06:44:10.661>
creator = 'ZackerySpytz'
dependencies = []
files = []
hgrepos = []
issue_num = 34987
keywords = ['patch']
message_count = 8.0
messages = ['327732', '327733', '327739', '327960', '329465', '331139', '331146', '331147']
nosy_count = 3.0
nosy_names = ['serhiy.storchaka', 'ZackerySpytz', 'miss-islington']
pr_nums = ['9886', '10932', '10933']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue34987'
versions = ['Python 3.6', 'Python 3.7', 'Python 3.8']

[ZackerySpytz]

The get_class() call in save_reduce() is not checked for failure.

[serhiy-storchaka]

It is checked, and there is a comment about this.

    p = obj_class != cls;    /* true iff a problem */

[ZackerySpytz]

It is not properly checked: Py_DECREF() is always called on the result of get_class(), but get_class() can return NULL.

[serhiy-storchaka]

You are right. Although, get_class() can return NULL without set an exception. We have to set an exception in such case (the same exception as for obj_class != cls looks appropriate).

[serhiy-storchaka]

I was wrong. get_class() returns NULL when and only when an exception is set.

[serhiy-storchaka]

New changeset 25d3897 by Serhiy Storchaka (Zackery Spytz) in branch 'master':
bpo-34987: Fix a possible null pointer dereference in _pickle.c's save_reduce(). (GH-9886)
25d3897

[miss-islington]

New changeset e2f376f by Miss Islington (bot) in branch '3.7':
bpo-34987: Fix a possible null pointer dereference in _pickle.c's save_reduce(). (GH-9886)
e2f376f

[miss-islington]

New changeset 92d912c by Miss Islington (bot) in branch '3.6':
bpo-34987: Fix a possible null pointer dereference in _pickle.c's save_reduce(). (GH-9886)
92d912c