bpo-35504: Fix segfaults and SystemErrors when deleting certain attrs. (GH-11175)

(cherry picked from commit 842acaa)

Co-authored-by: Zackery Spytz <zspytz@gmail.com>

Author: miss-islington

Lib/ctypes/test/test_strings.py

@@ -54,6 +54,13 @@ def test_param_2(self):
 ##        print BUF.from_param(c_char_p("python"))
 ##        print BUF.from_param(BUF(*"pyth"))
 
+    def test_del_segfault(self):
+        BUF = c_char * 4
+        buf = BUF()
+        with self.assertRaises(AttributeError):
+            del buf.raw
+
+
 @need_symbol('c_wchar')
 class WStringArrayTestCase(unittest.TestCase):
     def test(self):

Lib/sqlite3/test/regression.py

@@ -379,6 +379,10 @@ def callback(*args):
         del ref
         support.gc_collect()
 
+    def CheckDelIsolation_levelSegfault(self):
+        with self.assertRaises(AttributeError):
+            del self.con.isolation_level
+
 
 class UnhashableFunc:
     __hash__ = None

Lib/test/multibytecodec_support.py

@@ -277,6 +277,11 @@ def test_streamwriter_reset_no_pending(self):
         writer = self.writer(stream)
         writer.reset()
 
+    def test_incrementalencoder_del_segfault(self):
+        e = self.incrementalencoder()
+        with self.assertRaises(AttributeError):
+            del e.errors
+
 
 class TestBase_Mapping(unittest.TestCase):
     pass_enctest = []

Lib/test/test_asyncio/test_futures.py

@@ -566,6 +566,13 @@ class CFutureTests(BaseFutureTests, test_utils.TestCase):
     except AttributeError:
         cls = None
 
+    def test_future_del_segfault(self):
+        fut = self._new_future(loop=self.loop)
+        with self.assertRaises(AttributeError):
+            del fut._asyncio_future_blocking
+        with self.assertRaises(AttributeError):
+            del fut._log_traceback
+
 
 @unittest.skipUnless(hasattr(futures, '_CFuture'),
                      'requires the C _asyncio module')

Lib/test/test_asyncio/test_tasks.py

@@ -2512,6 +2512,15 @@ def coro():
             self.loop.run_until_complete(task)
         self.assertAlmostEqual(gettotalrefcount() - refs_before, 0, delta=10)
 
+    def test_del__log_destroy_pending_segfault(self):
+        @asyncio.coroutine
+        def coro():
+            pass
+        task = self.new_task(self.loop, coro())
+        self.loop.run_until_complete(task)
+        with self.assertRaises(AttributeError):
+            del task._log_destroy_pending
+
 
 @unittest.skipUnless(hasattr(futures, '_CFuture') and
                      hasattr(tasks, '_CTask'),

Lib/test/test_frame.py

@@ -109,10 +109,7 @@ class C:
             self.assertIs(None, wr())
 
 
-class FrameLocalsTest(unittest.TestCase):
-    """
-    Tests for the .f_locals attribute.
-    """
+class FrameAttrsTest(unittest.TestCase):
 
     def make_frames(self):
         def outer():
@@ -159,6 +156,11 @@ def test_locals_clear_locals(self):
         self.assertEqual(outer.f_locals, {})
         self.assertEqual(inner.f_locals, {})
 
+    def test_f_lineno_del_segfault(self):
+        f, _, _ = self.make_frames()
+        with self.assertRaises(AttributeError):
+            del f.f_lineno
+
 
 class ReprTest(unittest.TestCase):
     """

Lib/test/test_io.py

@@ -3635,6 +3635,11 @@ def test_rwpair_cleared_before_textio(self):
             t2.buddy = t1
         support.gc_collect()
 
+    def test_del__CHUNK_SIZE_SystemError(self):
+        t = self.TextIOWrapper(self.BytesIO(), encoding='ascii')
+        with self.assertRaises(AttributeError):
+            del t._CHUNK_SIZE
+
 
 class PyTextIOWrapperTest(TextIOWrapperTest):
     io = pyio

Misc/NEWS.d/next/Core and Builtins/2018-12-15-14-01-45.bpo-35504.JtKczP.rst

@@ -0,0 +1,2 @@
+Fix segfaults and :exc:`SystemError`\ s when deleting certain attributes.
+Patch by Zackery Spytz.

Modules/_asynciomodule.c

@@ -1110,6 +1110,10 @@ FutureObj_set_blocking(FutureObj *fut, PyObject *val, void *Py_UNUSED(ignored))
     if (future_ensure_alive(fut)) {
         return -1;
     }
+    if (val == NULL) {
+        PyErr_SetString(PyExc_AttributeError, "cannot delete attribute");
+        return -1;
+    }
 
     int is_true = PyObject_IsTrue(val);
     if (is_true < 0) {
@@ -1134,6 +1138,10 @@ FutureObj_get_log_traceback(FutureObj *fut, void *Py_UNUSED(ignored))
 static int
 FutureObj_set_log_traceback(FutureObj *fut, PyObject *val, void *Py_UNUSED(ignored))
 {
+    if (val == NULL) {
+        PyErr_SetString(PyExc_AttributeError, "cannot delete attribute");
+        return -1;
+    }
     int is_true = PyObject_IsTrue(val);
     if (is_true < 0) {
         return -1;
@@ -2008,6 +2016,10 @@ TaskObj_get_log_destroy_pending(TaskObj *task, void *Py_UNUSED(ignored))
 static int
 TaskObj_set_log_destroy_pending(TaskObj *task, PyObject *val, void *Py_UNUSED(ignored))
 {
+    if (val == NULL) {
+        PyErr_SetString(PyExc_AttributeError, "cannot delete attribute");
+        return -1;
+    }
     int is_true = PyObject_IsTrue(val);
     if (is_true < 0) {
         return -1;

Modules/_ctypes/_ctypes.c

@@ -1171,6 +1171,10 @@ CharArray_set_raw(CDataObject *self, PyObject *value, void *Py_UNUSED(ignored))
     Py_ssize_t size;
     Py_buffer view;
 
+    if (value == NULL) {
+        PyErr_SetString(PyExc_AttributeError, "cannot delete attribute");
+        return -1;
+    }
     if (PyObject_GetBuffer(value, &view, PyBUF_SIMPLE) < 0)
         return -1;
     size = view.len;