changeset:   95858:0e8c9cf1fede
branch:      3.3
parent:      95787:0d8f15053f42
user:        Benjamin Peterson <benjamin@python.org>
date:        Sat May 02 22:28:04 2015 -0400
files:       Lib/test/test_json/test_dump.py Misc/NEWS Modules/_json.c
description:
just sort the items tuple directly (closes #24094)


diff -r 0d8f15053f42 -r 0e8c9cf1fede Lib/test/test_json/test_dump.py
--- a/Lib/test/test_json/test_dump.py	Thu Apr 23 17:05:07 2015 -0400
+++ b/Lib/test/test_json/test_dump.py	Sat May 02 22:28:04 2015 -0400
@@ -28,6 +28,25 @@
         self.assertEqual(self.dumps(a, default=crasher),
                  '[null, null, null, null, null]')
 
+    # Issue 24094
+    def test_encode_evil_dict(self):
+        class D(dict):
+            def keys(self):
+                return L
+
+        class X:
+            def __hash__(self):
+                del L[0]
+                return 1337
+
+            def __lt__(self, o):
+                return 0
+
+        L = [X() for i in range(1122)]
+        d = D()
+        d[1337] = "true.dat"
+        self.assertEqual(self.dumps(d, sort_keys=True), '{"1337": "true.dat"}')
+
 
 class TestPyDump(TestDump, PyTest): pass
 
diff -r 0d8f15053f42 -r 0e8c9cf1fede Misc/NEWS
--- a/Misc/NEWS	Thu Apr 23 17:05:07 2015 -0400
+++ b/Misc/NEWS	Sat May 02 22:28:04 2015 -0400
@@ -19,6 +19,9 @@
 Library
 -------
 
+- Issue #24094: Fix possible crash in json.encode with poorly behaved dict
+  subclasses.
+
 - Issue #23367: Fix possible overflows in the unicodedata module.
 
 - Issue #23361: Fix possible overflow in Windows subprocess creation code.
diff -r 0d8f15053f42 -r 0e8c9cf1fede Modules/_json.c
--- a/Modules/_json.c	Thu Apr 23 17:05:07 2015 -0400
+++ b/Modules/_json.c	Sat May 02 22:28:04 2015 -0400
@@ -1527,35 +1527,11 @@
         */
     }
 
-    if (PyObject_IsTrue(s->sort_keys)) {
-        /* First sort the keys then replace them with (key, value) tuples. */
-        Py_ssize_t i, nitems;
-        items = PyMapping_Keys(dct);
-        if (items == NULL)
-            goto bail;
-        if (!PyList_Check(items)) {
-            PyErr_SetString(PyExc_ValueError, "keys must return list");
-            goto bail;
-        }
-        if (PyList_Sort(items) < 0)
-            goto bail;
-        nitems = PyList_GET_SIZE(items);
-        for (i = 0; i < nitems; i++) {
-            PyObject *key, *value;
-            key = PyList_GET_ITEM(items, i);
-            value = PyDict_GetItem(dct, key);
-            item = PyTuple_Pack(2, key, value);
-            if (item == NULL)
-                goto bail;
-            PyList_SET_ITEM(items, i, item);
-            Py_DECREF(key);
-        }
-    }
-    else {
-        items = PyMapping_Items(dct);
-    }
+    items = PyMapping_Items(dct);
     if (items == NULL)
         goto bail;
+    if (PyObject_IsTrue(s->sort_keys) && PyList_Sort(items) < 0)
+        goto bail;
     it = PyObject_GetIter(items);
     Py_DECREF(items);
     if (it == NULL)