Repository navigation
Conversation
In both uncollectable and collectables we would iterate through gc items using `GC_NEXT(gc)`. However in the case the current item was cleaned during iteration this would reuslt in UAF when fetching the next step in the loop. The fix is to move each item to a temporary `seen` list before printing it, and always take the next item from the head of the original list, so the loop never reads from a freed item. This takes a similar approach to `finalize_garbage()`.
|
Wonder if we just call |
sergey-miryanov
left a comment
sergey-miryanov
left a comment
There was a problem hiding this comment.
Same notes about tests and list traversal.
| } | ||
| stats.uncollectable = n; | ||
| stats.uncollectable = gc_list_size(&finalizers); |
There was a problem hiding this comment.
This requires an extra pass, which we should avoid.
|
A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated. Once you have made the requested changes, please leave a comment on this pull request containing the phrase |
In both uncollectable and collectables we would
iterate through gc items using
GC_NEXT(gc).However in the case the current item was cleaned
during iteration this would reuslt in UAF when
fetching the next step in the loop.
The fix is to move each item to a temporary
seenlistbefore printing it, and always take the next
item from the head of the original list, so the
loop never reads from a freed item. This takes
a similar approach to
finalize_garbage().