-
-
Notifications
You must be signed in to change notification settings - Fork 31.9k
bpo-36027: Fix a potential refcount bug in long_pow #26690
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
bpo-36027: Fix a potential refcount bug in long_pow #26690
Conversation
3.8 is in security-fix-only mode; adjusting the backport labels. |
Yes, this showed up for me because I introduced a new path that, for exponent 1 and no modulus, invoked REDUCE but not MULT. Without a modulus, REDUCE didn't overwrite |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ship it!
Thanks @mdickinson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.9. |
Sorry @mdickinson, I had trouble checking out the |
GH-26702 is a backport of this pull request to the 3.9 branch. |
(cherry picked from commit 5924243) Co-authored-by: Mark Dickinson <[email protected]>
…6690) (cherry picked from commit 5924243) Co-authored-by: Mark Dickinson <[email protected]>
GH-26703 is a backport of this pull request to the 3.10 branch. |
(cherry picked from commit 5924243) Co-authored-by: Mark Dickinson <[email protected]> Co-authored-by: Mark Dickinson <[email protected]>
…H-26703) (cherry picked from commit 5924243) Co-authored-by: Mark Dickinson <[email protected]>
This PR fixes a reference counting bug introduced in #13266 and identified by @tim-one in #26662: if we don't set
temp
toNULL
, and if the value it has at this point is retained until the end of the function, then we end up doing an extra decref. I spent some time trying to identify a test-case that exercises this bug, and failed - I couldn't find a code path wheretemp
isn't re-used at some point. Nevertheless, it's a potential point of fragility for maintenance of this code.https://bugs.python.org/issue36027