Commit 7e6829c7 authored by Kirill Smelkov's avatar Kirill Smelkov

bigfile/py: Fix crash in {pyvma,pyfileh}_dealloc() if deallocated object was not fully constructed

Consider e.g. this for pyvma:

    1. in pyfileh_mmap() pyvma is created

    2. next fileh_mmap(pyvma, pyfileh, ...) fails

    3. we need to deallocate pyvma which was not mapped

    4. in pyvma_dealloc() we unmap pyvma unconditionally -> boom.

The same story goes for pyfileh dealloc vs not fully constructing it in
pyfileh_open().
parent fcbb26e6
...@@ -172,9 +172,10 @@ pyvma_dealloc(PyObject *pyvma0) ...@@ -172,9 +172,10 @@ pyvma_dealloc(PyObject *pyvma0)
if (pyvma->in_weakreflist) if (pyvma->in_weakreflist)
PyObject_ClearWeakRefs(pyvma); PyObject_ClearWeakRefs(pyvma);
/* pyvma->fileh indicates whether vma was yet created (via fileh_mmap()) or not */
if (fileh) {
vma_unmap(pyvma); vma_unmap(pyvma);
if (fileh) {
PyBigFileH *pyfileh = upcast(PyBigFileH *, fileh); PyBigFileH *pyfileh = upcast(PyBigFileH *, fileh);
Py_DECREF(pyfileh); Py_DECREF(pyfileh);
} }
...@@ -260,7 +261,7 @@ PyFunc(pyfileh_mmap, "mmap(pgoffset, pglen) - map fileh part into memory") ...@@ -260,7 +261,7 @@ PyFunc(pyfileh_mmap, "mmap(pgoffset, pglen) - map fileh part into memory")
err = fileh_mmap(pyvma, pyfileh, pgoffset, pglen); err = fileh_mmap(pyvma, pyfileh, pgoffset, pglen);
if (err) { if (err) {
Py_DECREF(pyfileh); Py_DECREF(pyfileh);
Py_DECREF(pyvma); // XXX ok wrt delete pyvma->vma ? Py_DECREF(pyvma);
XPyErr_SetFromErrno(); XPyErr_SetFromErrno();
return NULL; return NULL;
} }
...@@ -327,9 +328,10 @@ pyfileh_dealloc(PyObject *pyfileh0) ...@@ -327,9 +328,10 @@ pyfileh_dealloc(PyObject *pyfileh0)
if (pyfileh->in_weakreflist) if (pyfileh->in_weakreflist)
PyObject_ClearWeakRefs(pyfileh); PyObject_ClearWeakRefs(pyfileh);
/* pyfileh->file indicates whether fileh was yet opened (via fileh_open()) or not */
if (file) {
fileh_close(pyfileh); fileh_close(pyfileh);
if (file) {
pyfile = upcast(PyBigFile *, file); pyfile = upcast(PyBigFile *, file);
Py_DECREF(pyfile); Py_DECREF(pyfile);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment