diff Objects/typeobject.c @ 83283:d5e5017309b1 2.7

Issue #16447: Fix potential segfault when setting __name__ on a class.
author Mark Dickinson <dickinsm@gmail.com>
date Sat, 13 Apr 2013 15:19:05 +0100
parents eaff15532b3c
children
line wrap: on
line diff
--- a/Objects/typeobject.c	Sat Apr 13 12:28:17 2013 +0300
+++ b/Objects/typeobject.c	Sat Apr 13 15:19:05 2013 +0100
@@ -225,6 +225,7 @@
 type_set_name(PyTypeObject *type, PyObject *value, void *context)
 {
     PyHeapTypeObject* et;
+    PyObject *tmp;
 
     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
         PyErr_Format(PyExc_TypeError,
@@ -253,10 +254,13 @@
 
     Py_INCREF(value);
 
-    Py_DECREF(et->ht_name);
+    /* Wait until et is a sane state before Py_DECREF'ing the old et->ht_name
+       value.  (Bug #16447.)  */
+    tmp = et->ht_name;
     et->ht_name = value;
 
     type->tp_name = PyString_AS_STRING(value);
+    Py_DECREF(tmp);
 
     return 0;
 }