Dangerous use of Py_XDECREF in _trait_set_validate
Open
type: bug
- Dominant language
- Python
- Stars
- 462
- Forks
- 90
- PR merge metrics
- No merged PRs in 30d
Description
There's a potentially dangerous use of `Py_XDECREF` in `_trait_set_validate`: https://github.com/enthought/traits/blob/69b1a4701e320d28ee783ce7e8e25df96dce648a/traits/ctraits.c#L4290
The chance of this being exploited by accident is fairly low, but nonzero.
The issue is that the `Py_XDECREF` call can cause arbitrary Python code to run, and then that Python code sees a trait object in an inconsistent state.
This is very similar to issue #844, and the fix would be similar, too. Writing a regression test may not be straightforward.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.