bpo-38588: Fix possible crashes in dict and list when calling PyObject_RichCompareBool

[corona10]

Based on LCatro's report

https://bugs.python.org/issue38588

[pablogsal]

Could you include the rest of the cases that LCatro was mentioning? He mentioned another 2 for lists.

[corona10]

@pablogsal

poc3 is not reproducible on my local mac machine and Linux machine with the master branch.
Looks like the master branch code was changed

cpython/Objects/listobject.c

Line 452 in 3c87a66

cmp=PyObject_RichCompareBool(PyList_GET_ITEM(a, i), el, Py_EQ);

However poc2 is reproducible, so I will add the patch on this PR.

$ cat poc3.py class poc() : def __eq__(self,other) :list1.clear() return NotImplemented list1 = [ set() ] poc() in list1 print('end') $ ./python poc3.py end

[ZackerySpytz]

FWIW, LCatro had opened another issue (https://bugs.python.org/issue38610) for similar crashes in the index(), count(), and remove() methods of list. I had created GH-17022 to address them.

[corona10]

@pablogsal
Please take a look,
I 've added the list case patch except which is not reproducible in the master branch.
(I've attached the script above)

And for the list_richcompare I've added more cases that were not reported by LCatro.
Both cases are added in the unit test and fixed.

And IMHO, we can close bpo-38588 with this patch
:)

[corona10]

@pablogsal Updated!

[pablogsal]

LGTM

Thanks for the quick fix, @corona10!

[miss-islington]

Thanks @corona10 for the PR, and @pablogsal for merging it 🌮🎉.. I'm working now to backport this PR to: 3.7, 3.8.
🐍🍒⛏🤖

[miss-islington]

I'm having trouble backporting to 3.8. Reason: 'Error 110 while writing to socket. Connection timed out.'. Please retry by removing and re-adding the needs backport to 3.8 label.

[miss-islington]

Sorry, @corona10 and @pablogsal, I could not cleanly backport this to 3.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 2d5bf568eaa5059402ccce9ba5a366986ba27c8a 3.7

[pablogsal]

@corona10 Can you make the backport to 3.7 and 3.8 using cherry_picker?

[miss-islington]

Thanks @corona10 for the PR, and @pablogsal for merging it 🌮🎉.. I'm working now to backport this PR to: 3.8.
🐍🍒⛏🤖

[miss-islington]

Sorry @corona10 and @pablogsal, I had trouble checking out the 3.8 backport branch.
Please backport using cherry_picker on command line.
cherry_picker 2d5bf568eaa5059402ccce9ba5a366986ba27c8a 3.8

[bedevere-bot]

GH-17764 is a backport of this pull request to the 3.8 branch.

[methane]

Oh, please check the b.p.o before merge...

[pablogsal]

Oh, please check the b.p.o before merge...

Apologies, I had totally missed the comment in bpo :(

[bedevere-bot]

GH-17765 is a backport of this pull request to the 3.7 branch.

[pablogsal]

Sorry @corona10, I will leave the backports open until we decide what to do finally in the bpo issue.

[corona10]

@pablogsal cc @methane
Yes, that should be done first :)