go-python / gpython

gpython is a python interpreter written in go "batteries not included"
BSD 3-Clause "New" or "Revised" License
870 stars 95 forks source link

Incorrect elementtree operation cause double free of memory. #198

Closed xiaxinmeng closed 1 year ago

xiaxinmeng commented 1 year ago

The following code (test.py) starts twice of a elementtree and crashes gpython after closed. The memory is double freed in tcache 2.

Crash message: AAAABBBB AAAABBBB free(): double free detected in tcache 2 Aborted (core dumped)

test.py

import _elementtree as et

class X(str):

    def __del__(self):
        print(elem.text)
b = et.TreeBuilder()
b.start('test')
b.data(['AAAA', X('BBBB')])
b.start('test2')
elem = b.close()
print(elem.text)

Environment:gpython 0.1.0 on Ubuntu 18.04, and gpython main(https://github.com/go-python/gpython/commit/6f8e06a4660709ab44398d8b1a18738aa407b1c3 on Oct 5)

ncw commented 1 year ago

gpython doesn't come with the _elementtree module - where did you get these from?

Please give steps to reproduce with gpython

Thanks