From 686bc1175b058756c07822563c0b0ef354326743 Mon Sep 17 00:00:00 2001 From: Pablo Galindo Date: Sat, 27 Mar 2021 01:33:46 +0000 Subject: [PATCH 1/2] bpo-43636: Validate the version tag in _PyType_Lookup --- Objects/typeobject.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Objects/typeobject.c b/Objects/typeobject.c index d1bbbe77ee1b98..338128b6639f9f 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -424,7 +424,7 @@ assign_version_tag(struct type_cache *cache, PyTypeObject *type) if (type->tp_version_tag == 0) { // Wrap-around or just starting Python - clear the whole cache type_cache_clear(cache, 1); - return 1; + return 0; } bases = type->tp_bases; From 589c3dafe11352e3fe2407b88ad0c0a4c8d65018 Mon Sep 17 00:00:00 2001 From: Pablo Galindo Date: Sat, 27 Mar 2021 01:55:37 +0000 Subject: [PATCH 2/2] Add asserts in the critical sections --- Objects/typeobject.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Objects/typeobject.c b/Objects/typeobject.c index 338128b6639f9f..8dafbbf297733d 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -3361,6 +3361,7 @@ _PyType_Lookup(PyTypeObject *type, PyObject *name) #if MCACHE_STATS cache->hits++; #endif + assert(_PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG)); return entry->value; } @@ -3398,6 +3399,7 @@ _PyType_Lookup(PyTypeObject *type, PyObject *name) cache->misses++; } #endif + assert(_PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG)); Py_SETREF(entry->name, Py_NewRef(name)); } return res;