go-python/gpython

Incorrect elementtree operation cause double free of memory.

xiaxinmeng opened this issue · 1 comments

The following code (test.py) starts twice of a elementtree and crashes gpython after closed. The memory is double freed in tcache 2.

Crash message:
AAAABBBB
AAAABBBB
free(): double free detected in tcache 2
Aborted (core dumped)

test.py

import _elementtree as et

class X(str):

    def __del__(self):
        print(elem.text)
b = et.TreeBuilder()
b.start('test')
b.data(['AAAA', X('BBBB')])
b.start('test2')
elem = b.close()
print(elem.text)

Environment:gpython 0.1.0 on Ubuntu 18.04, and gpython main(6f8e06a on Oct 5)

ncw commented

gpython doesn't come with the _elementtree module - where did you get these from?

Please give steps to reproduce with gpython

Thanks