bpo-28963: Fix out of bound iteration in asyncio.Future.remove_done_callback/C (#408)

1st1 · web-flow · commit 84af903f3bc6 · 2017-03-02T23:46:56.000-05:00
diff --git a/Lib/test/test_asyncio/test_futures.py b/Lib/test/test_asyncio/test_futures.py
@@ -569,6 +569,35 @@ def test_remove_done_callback(self):
         self.assertEqual(bag, [2])
         self.assertEqual(f.result(), 'foo')
 
+    def test_remove_done_callbacks_list_mutation(self):
+        # see http://bugs.python.org/issue28963 for details
+
+        fut = self._new_future()
+        fut.add_done_callback(str)
+
+        for _ in range(63):
+            fut.add_done_callback(id)
+
+        class evil:
+            def __eq__(self, other):
+                fut.remove_done_callback(id)
+                return False
+
+        fut.remove_done_callback(evil())
+
+    def test_schedule_callbacks_list_mutation(self):
+        # see http://bugs.python.org/issue28963 for details
+
+        def mut(f):
+            f.remove_done_callback(str)
+
+        fut = self._new_future()
+        fut.add_done_callback(mut)
+        fut.add_done_callback(str)
+        fut.add_done_callback(str)
+        fut.set_result(1)
+        test_utils.run_briefly(self.loop)
+
 
 @unittest.skipUnless(hasattr(futures, '_CFuture'),
                      'requires the C _asyncio module')
diff --git a/Misc/NEWS b/Misc/NEWS
@@ -259,6 +259,9 @@ Extension Modules
 Library
 -------
 
+- bpo-28963: Fix out of bound iteration in asyncio.Future.remove_done_callback 
+  implemented in C.
+
 - bpo-29704: asyncio.subprocess.SubprocessStreamProtocol no longer closes before
   all pipes are closed.
 
diff --git a/Modules/_asynciomodule.c b/Modules/_asynciomodule.c
@@ -522,7 +522,7 @@ _asyncio_Future_remove_done_callback(FutureObj *self, PyObject *fn)
         return NULL;
     }
 
-    for (i = 0; i < len; i++) {
+    for (i = 0; i < PyList_GET_SIZE(self->fut_callbacks); i++) {
         int ret;
         PyObject *item = PyList_GET_ITEM(self->fut_callbacks, i);
 

Original file line number	Diff line number	Diff line change
`@@ -522,7 +522,7 @@ _asyncio_Future_remove_done_callback(FutureObj self, PyObject fn)`
`522`	`522`	`return NULL;`
`523`	`523`	`}`
`524`	`524`
`525`		`- for (i = 0; i < len; i++) {`
	`525`	`+ for (i = 0; i < PyList_GET_SIZE(self->fut_callbacks); i++) {`
`526`	`526`	`int ret;`
`527`	`527`	`PyObject *item = PyList_GET_ITEM(self->fut_callbacks, i);`
`528`	`528`