From 036c006cefe471a774b837acf0325282e3ad15d0 Mon Sep 17 00:00:00 2001 From: Campbell Barton Date: Thu, 14 Jul 2016 18:27:20 +1000 Subject: [PATCH] PyAPI: Leak fix caused crash w/ attr swap trick Accessing `bpy.app.binary_path_python does search, then swaps its getset with the string it finds. This caused a freed pointer to be stored in bpy.app's dictionary. Fix by using the same string for get/set access. --- source/blender/python/intern/bpy_app.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/source/blender/python/intern/bpy_app.c b/source/blender/python/intern/bpy_app.c index 93c97d48bac..727d980b182 100644 --- a/source/blender/python/intern/bpy_app.c +++ b/source/blender/python/intern/bpy_app.c @@ -236,7 +236,7 @@ static int bpy_app_debug_set(PyObject *UNUSED(self), PyObject *value, void *clos PyDoc_STRVAR(bpy_app_binary_path_python_doc, "String, the path to the python executable (read-only)" ); -static PyObject *bpy_app_binary_path_python_get(PyObject *UNUSED(self), void *UNUSED(closure)) +static PyObject *bpy_app_binary_path_python_get(PyObject *self, void *UNUSED(closure)) { /* refcount is held in BlenderAppType.tp_dict */ static PyObject *ret = NULL; @@ -248,7 +248,7 @@ static PyObject *bpy_app_binary_path_python_get(PyObject *UNUSED(self), void *UN fullpath, sizeof(fullpath), PY_MAJOR_VERSION, PY_MINOR_VERSION); ret = PyC_UnicodeFromByte(fullpath); - PyDict_SetItemString(BlenderAppType.tp_dict, "binary_path_python", ret); + PyDict_SetItem(BlenderAppType.tp_dict, PyDescr_NAME(self), ret); } else { Py_INCREF(ret); @@ -358,7 +358,7 @@ static void py_struct_seq_getset_init(void) /* tricky dynamic members, not to py-spec! */ for (PyGetSetDef *getset = bpy_app_getsets; getset->name; getset++) { PyObject *item = PyDescr_NewGetSet(&BlenderAppType, getset); - PyDict_SetItemString(BlenderAppType.tp_dict, getset->name, item); + PyDict_SetItem(BlenderAppType.tp_dict, PyDescr_NAME(item), item); Py_DECREF(item); } }