Skip to content
Snippets Groups Projects
Commit 5b6e9c49 authored by Ben Boeckel's avatar Ben Boeckel Committed by David Gobbi
Browse files

PyVTKObject: own the classname memory

In Python3, we take the actual object and construct a new bytes() object
from it. We then take a pointer to its data and decref the bytes object.
If the garbage collector runs between the decref and the use of the
classname variable further down, it is a use-after-free.
parent 7d78e329
No related branches found
No related tags found
No related merge requests found
......@@ -487,14 +487,14 @@ PyObject *PyVTKObject_FromPointer(
{
// This will be set if we create a new C++ object
bool created = false;
const char *classname = vtkPythonUtil::StripModule(pytype->tp_name);
std::string classname = vtkPythonUtil::StripModule(pytype->tp_name);
PyVTKClass *cls = 0;
if (ptr)
{
// If constructing from an existing C++ object, use its actual class
classname = ptr->GetClassName();
cls = vtkPythonUtil::FindClass(classname);
cls = vtkPythonUtil::FindClass(classname.c_str());
}
if (cls == 0)
......@@ -511,14 +511,15 @@ PyObject *PyVTKObject_FromPointer(
s = tmp;
}
#endif
classname = PyBytes_AsString(s);
if (classname == 0)
const char *vtkname_classname = PyBytes_AsString(s);
if (vtkname_classname == 0)
{
Py_DECREF(s);
return NULL;
}
classname = vtkname_classname;
}
cls = vtkPythonUtil::FindClass(classname);
cls = vtkPythonUtil::FindClass(classname.c_str());
if (cls == 0)
{
PyErr_Format(PyExc_ValueError,
......@@ -550,7 +551,7 @@ PyObject *PyVTKObject_FromPointer(
// Check the type of the newly-created object
const char *newclassname = ptr->GetClassName();
if (strcmp(newclassname, classname) != 0)
if (newclassname == classname)
{
PyVTKClass *newclass = vtkPythonUtil::FindClass(newclassname);
if (newclass)
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment