changeset:   96760:24197b5f7126
branch:      3.5
parent:      96757:2be983173f45
parent:      96759:24ce32d76376
user:        Benjamin Peterson <benjamin@python.org>
date:        Thu Jul 02 16:18:58 2015 -0500
files:       Lib/test/pickletester.py Misc/NEWS Modules/_pickle.c
description:
merge 3.4 (#24552)


diff -r 2be983173f45 -r 24197b5f7126 Lib/test/pickletester.py
--- a/Lib/test/pickletester.py	Thu Jul 02 20:27:56 2015 +0200
+++ b/Lib/test/pickletester.py	Thu Jul 02 16:18:58 2015 -0500
@@ -1039,6 +1039,18 @@
                 self.assertEqual(B(x), B(y), detail)
                 self.assertEqual(x.__dict__, y.__dict__, detail)
 
+    def test_newobj_not_class(self):
+        # Issue 24552
+        global SimpleNewObj
+        save = SimpleNewObj
+        o = object.__new__(SimpleNewObj)
+        b = self.dumps(o, 4)
+        try:
+            SimpleNewObj = 42
+            self.assertRaises((TypeError, pickle.UnpicklingError), self.loads, b)
+        finally:
+            SimpleNewObj = save
+
     # Register a type with copyreg, with extension code extcode.  Pickle
     # an object of that type.  Check that the resulting pickle uses opcode
     # (EXT[124]) under proto 2, and not in proto 1.
diff -r 2be983173f45 -r 24197b5f7126 Misc/NEWS
--- a/Misc/NEWS	Thu Jul 02 20:27:56 2015 +0200
+++ b/Misc/NEWS	Thu Jul 02 16:18:58 2015 -0500
@@ -30,6 +30,8 @@
 Library
 -------
 
+- Issue #24552: Fix use after free in an error case of the _pickle module.
+
 - Issue #24514: tarfile now tolerates number fields consisting of only
   whitespace.
 
diff -r 2be983173f45 -r 24197b5f7126 Modules/_pickle.c
--- a/Modules/_pickle.c	Thu Jul 02 20:27:56 2015 +0200
+++ b/Modules/_pickle.c	Thu Jul 02 16:18:58 2015 -0500
@@ -5279,10 +5279,10 @@
     if (!PyType_Check(cls)) {
         Py_DECREF(kwargs);
         Py_DECREF(args);
-        Py_DECREF(cls);
         PyErr_Format(st->UnpicklingError,
                      "NEWOBJ_EX class argument must be a type, not %.200s",
                      Py_TYPE(cls)->tp_name);
+        Py_DECREF(cls);
         return -1;
     }