Kaydet (Commit) 5877bc3d authored tarafından Martin v. Löwis's avatar Martin v. Löwis

Add recursion limit to pickling. Fixes #576084.

üst d412a12f
...@@ -313,6 +313,7 @@ typedef struct Picklerobject { ...@@ -313,6 +313,7 @@ typedef struct Picklerobject {
PyObject *inst_pers_func; PyObject *inst_pers_func;
int bin; int bin;
int fast; /* Fast mode doesn't save in memo, don't use if circ ref */ int fast; /* Fast mode doesn't save in memo, don't use if circ ref */
int nesting;
int (*write_func)(struct Picklerobject *, char *, int); int (*write_func)(struct Picklerobject *, char *, int);
char *write_buf; char *write_buf;
int buf_size; int buf_size;
...@@ -1850,6 +1851,12 @@ save(Picklerobject *self, PyObject *args, int pers_save) { ...@@ -1850,6 +1851,12 @@ save(Picklerobject *self, PyObject *args, int pers_save) {
*callable = 0, *state = 0; *callable = 0, *state = 0;
int res = -1, tmp, size; int res = -1, tmp, size;
if (self->nesting++ > Py_GetRecursionLimit()){
PyErr_SetString(PyExc_RuntimeError,
"maximum recursion depth exceeded");
goto finally;
}
if (!pers_save && self->pers_func) { if (!pers_save && self->pers_func) {
if ((tmp = save_pers(self, args, self->pers_func)) != 0) { if ((tmp = save_pers(self, args, self->pers_func)) != 0) {
res = tmp; res = tmp;
...@@ -2068,6 +2075,7 @@ save(Picklerobject *self, PyObject *args, int pers_save) { ...@@ -2068,6 +2075,7 @@ save(Picklerobject *self, PyObject *args, int pers_save) {
PyErr_SetObject(UnpickleableError, args); PyErr_SetObject(UnpickleableError, args);
finally: finally:
self->nesting--;
Py_XDECREF(py_ob_id); Py_XDECREF(py_ob_id);
Py_XDECREF(__reduce__); Py_XDECREF(__reduce__);
Py_XDECREF(t); Py_XDECREF(t);
...@@ -2287,6 +2295,7 @@ newPicklerobject(PyObject *file, int bin) { ...@@ -2287,6 +2295,7 @@ newPicklerobject(PyObject *file, int bin) {
self->write_buf = NULL; self->write_buf = NULL;
self->bin = bin; self->bin = bin;
self->fast = 0; self->fast = 0;
self->nesting = 0;
self->fast_container = 0; self->fast_container = 0;
self->fast_memo = NULL; self->fast_memo = NULL;
self->buf_size = 0; self->buf_size = 0;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment