Issue 25902: Fixed various refcount issues in ElementTree iteration [proxy]

The Wayback Machine - https://web.archive.org/web/20210523041333/https://bugs.python.org/issue25902

Issue25902

classification

Title:	Fixed various refcount issues in ElementTree iteration
Type:	crash	Stage:	resolved
Components:	Extension Modules, XML	Versions:	Python 3.6, Python 3.5

process

Status:	closed	Resolution:	fixed
Dependencies:		Superseder:
Assigned To:	serhiy.storchaka	Nosy List:	martin.panter, python-dev, serhiy.storchaka
Priority:	normal	Keywords:	patch

Created on 2015-12-18 12:04 by serhiy.storchaka, last changed 2015-12-21 10:40 by serhiy.storchaka. This issue is now closed.

Messages (5)
msg256673 - (view)	Author: Serhiy Storchaka (serhiy.storchaka) *	Date: 2015-12-18 12:04
ElementTree iteration code holds borrowed references when call user code (comparison with the tag, concatenating text and tail lazy lists, testing text and tail for empty). User code can make borrowed references invalid and this can lead to a crash. One example is provided by Martin in msg256495. Other possible cases can be more hard to reproduce. Proposed patch makes iterating code to own references that it operates.
msg256767 - (view)	Author: Serhiy Storchaka (serhiy.storchaka) *	Date: 2015-12-20 15:55
Added tests.
msg256782 - (view)	Author: Martin Panter (martin.panter) *	Date: 2015-12-21 03:54
Left some comments about possibly unnecessary ref counting. Other than that it seems okay.
msg256786 - (view)	Author: Roundup Robot (python-dev)	Date: 2015-12-21 09:13
New changeset 00b6a13cfd70 by Serhiy Storchaka in branch '3.5': Issue #25902: Fixed various refcount issues in ElementTree iteration. https://hg.python.org/cpython/rev/00b6a13cfd70 New changeset e09cb2af3092 by Serhiy Storchaka in branch 'default': Issue #25902: Fixed various refcount issues in ElementTree iteration. https://hg.python.org/cpython/rev/e09cb2af3092
msg256794 - (view)	Author: Serhiy Storchaka (serhiy.storchaka) *	Date: 2015-12-21 10:40
Thank you Martin. Actually this patch is for 3.5 only. In 3.6 the code will be rewrote (issue25873).

History
Date	User	Action	Args
2015-12-21 10:40:14	serhiy.storchaka	set	status: open -> closed versions: - Python 2.7 messages: + msg256794 resolution: fixed stage: patch review -> resolved
2015-12-21 09:13:37	python-dev	set	nosy: + python-dev messages: + msg256786
2015-12-21 03:54:43	martin.panter	set	messages: + msg256782
2015-12-20 15:55:57	serhiy.storchaka	set	files: + etree_iter_refcount_2.patch messages: + msg256767
2015-12-20 14:39:35	serhiy.storchaka	set	assignee: serhiy.storchaka
2015-12-18 12:04:44	serhiy.storchaka	create