bpo-43636: Validate the version tag in _PyType_Lookup (GH-25032)

pablogsal · web-flow · commit 11b85abbae8a · 2021-03-27T03:51:46.000Z
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
@@ -424,7 +424,7 @@ assign_version_tag(struct type_cache *cache, PyTypeObject *type)
     if (type->tp_version_tag == 0) {
         // Wrap-around or just starting Python - clear the whole cache
         type_cache_clear(cache, 1);
-        return 1;
+        return 0;
     }
 
     bases = type->tp_bases;
@@ -3361,6 +3361,7 @@ _PyType_Lookup(PyTypeObject *type, PyObject *name)
 #if MCACHE_STATS
         cache->hits++;
 #endif
+        assert(_PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG));
         return entry->value;
     }
 
@@ -3398,6 +3399,7 @@ _PyType_Lookup(PyTypeObject *type, PyObject *name)
             cache->misses++;
         }
 #endif
+        assert(_PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG));
         Py_SETREF(entry->name, Py_NewRef(name));
     }
     return res;

Original file line number	Diff line number	Diff line change
`@@ -424,7 +424,7 @@ assign_version_tag(struct type_cache cache, PyTypeObject type)`
`424`	`424`	`if (type->tp_version_tag == 0) {`
`425`	`425`	`// Wrap-around or just starting Python - clear the whole cache`
`426`	`426`	`type_cache_clear(cache, 1);`
`427`		`- return 1;`
	`427`	`+ return 0;`
`428`	`428`	`}`
`429`	`429`
`430`	`430`	`bases = type->tp_bases;`
`@@ -3361,6 +3361,7 @@ _PyType_Lookup(PyTypeObject type, PyObject name)`
`3361`	`3361`	`#if MCACHE_STATS`
`3362`	`3362`	`cache->hits++;`
`3363`	`3363`	`#endif`
	`3364`	`+ assert(_PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG));`
`3364`	`3365`	`return entry->value;`
`3365`	`3366`	`}`
`3366`	`3367`
`@@ -3398,6 +3399,7 @@ _PyType_Lookup(PyTypeObject type, PyObject name)`
`3398`	`3399`	`cache->misses++;`
`3399`	`3400`	`}`
`3400`	`3401`	`#endif`
	`3402`	`+ assert(_PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG));`
`3401`	`3403`	`Py_SETREF(entry->name, Py_NewRef(name));`
`3402`	`3404`	`}`
`3403`	`3405`	`return res;`