Enforce conditions on the internal tuple

picnixz · picnixz · commit f7b67309e886 · 2024-10-23T15:15:31.000+02:00
diff --git a/Modules/_asynciomodule.c b/Modules/_asynciomodule.c
@@ -457,7 +457,7 @@ future_schedule_callbacks(asyncio_state *state, FutureObj *fut)
             break; // done
         }
         PyObject *cb_tup = PyList_GET_ITEM(fut->fut_callbacks, i);
-        if (!PyTuple_CheckExact(cb_tup) || PyTuple_GET_SIZE(cb_tup) < 2) {
+        if (!PyTuple_CheckExact(cb_tup) || PyTuple_GET_SIZE(cb_tup) != 2) {
             PyErr_SetString(PyExc_RuntimeError, "corrupted callback tuple");
             return -1;
         }
@@ -1073,7 +1073,7 @@ _asyncio_Future_remove_done_callback_impl(FutureObj *self, PyTypeObject *cls,
         // Beware: An evil PyObject_RichCompareBool could change fut_callbacks
         // or its items (see https://github.com/python/cpython/issues/97592 or
         // https://github.com/python/cpython/issues/125789 for details).
-        if (!PyTuple_CheckExact(cb_tup) || PyTuple_GET_SIZE(cb_tup) < 1) {
+        if (!PyTuple_CheckExact(cb_tup) || PyTuple_GET_SIZE(cb_tup) != 2) {
             PyErr_SetString(PyExc_RuntimeError, "corrupted callback tuple");
             return NULL;
         }
@@ -1110,7 +1110,7 @@ _asyncio_Future_remove_done_callback_impl(FutureObj *self, PyTypeObject *cls,
             break; // done
         }
         PyObject *cb_tup = PyList_GET_ITEM(self->fut_callbacks, i);
-        if (!PyTuple_CheckExact(cb_tup) || PyTuple_GET_SIZE(cb_tup) < 1) {
+        if (!PyTuple_CheckExact(cb_tup) || PyTuple_GET_SIZE(cb_tup) != 2) {
             PyErr_SetString(PyExc_RuntimeError, "corrupted callback tuple");
             goto fail;
         }

Original file line number	Diff line number	Diff line change
`@@ -457,7 +457,7 @@ future_schedule_callbacks(asyncio_state state, FutureObj fut)`
`457`	`457`	`break; // done`
`458`	`458`	`}`
`459`	`459`	`PyObject *cb_tup = PyList_GET_ITEM(fut->fut_callbacks, i);`
`460`		`- if (!PyTuple_CheckExact(cb_tup) \|\| PyTuple_GET_SIZE(cb_tup) < 2) {`
	`460`	`+ if (!PyTuple_CheckExact(cb_tup) \|\| PyTuple_GET_SIZE(cb_tup) != 2) {`
`461`	`461`	`PyErr_SetString(PyExc_RuntimeError, "corrupted callback tuple");`
`462`	`462`	`return -1;`
`463`	`463`	`}`
`@@ -1073,7 +1073,7 @@ _asyncio_Future_remove_done_callback_impl(FutureObj self, PyTypeObject cls,`
`1073`	`1073`	`// Beware: An evil PyObject_RichCompareBool could change fut_callbacks`
`1074`	`1074`	`// or its items (see https://github.com/python/cpython/issues/97592 or`
`1075`	`1075`	`// https://github.com/python/cpython/issues/125789 for details).`
`1076`		`- if (!PyTuple_CheckExact(cb_tup) \|\| PyTuple_GET_SIZE(cb_tup) < 1) {`
	`1076`	`+ if (!PyTuple_CheckExact(cb_tup) \|\| PyTuple_GET_SIZE(cb_tup) != 2) {`
`1077`	`1077`	`PyErr_SetString(PyExc_RuntimeError, "corrupted callback tuple");`
`1078`	`1078`	`return NULL;`
`1079`	`1079`	`}`
`@@ -1110,7 +1110,7 @@ _asyncio_Future_remove_done_callback_impl(FutureObj self, PyTypeObject cls,`
`1110`	`1110`	`break; // done`
`1111`	`1111`	`}`
`1112`	`1112`	`PyObject *cb_tup = PyList_GET_ITEM(self->fut_callbacks, i);`
`1113`		`- if (!PyTuple_CheckExact(cb_tup) \|\| PyTuple_GET_SIZE(cb_tup) < 1) {`
	`1113`	`+ if (!PyTuple_CheckExact(cb_tup) \|\| PyTuple_GET_SIZE(cb_tup) != 2) {`
`1114`	`1114`	`PyErr_SetString(PyExc_RuntimeError, "corrupted callback tuple");`
`1115`	`1115`	`goto fail;`
`1116`	`1116`	`}`