[Python-checkins] gh-115874: Don't use module state in teedataobject tp_dealloc (#116204)

[erlend-aasland]

https://github.com/python/cpython/commit/e2fcaf19d302b05d3466807bad0a61f39db2a51b
commit: e2fcaf19d302b05d3466807bad0a61f39db2a51b
branch: main
author: Erlend E. Aasland <erl...@python.org>
committer: erlend-aasland <erlend.aasl...@protonmail.com>
date: 2024-03-18T13:24:24+01:00
summary:

gh-115874: Don't use module state in teedataobject tp_dealloc (#116204)

Co-authored-by: Brandt Bucher <brandtbuc...@microsoft.com>

files:
M Lib/test/test_itertools.py
M Modules/itertoolsmodule.c

diff --git a/Lib/test/test_itertools.py b/Lib/test/test_itertools.py
index 9af0730ea98004..95e67911db6a7f 100644
--- a/Lib/test/test_itertools.py
+++ b/Lib/test/test_itertools.py
@@ -1,7 +1,7 @@
 import doctest
 import unittest
 from test import support
-from test.support import threading_helper
+from test.support import threading_helper, script_helper
 from itertools import *
 import weakref
 from decimal import Decimal
@@ -1699,6 +1699,14 @@ def test_tee(self):
             self.pickletest(proto, a, compare=ans)
             self.pickletest(proto, b, compare=ans)
 
+    def test_tee_dealloc_segfault(self):
+        # gh-115874: segfaults when accessing module state in tp_dealloc.
+        script = (
+            "import typing, copyreg, itertools; "
+            "copyreg.buggy_tee = itertools.tee(())"
+        )
+        script_helper.assert_python_ok("-c", script)
+
     # Issue 13454: Crash when deleting backward iterator from tee()
     def test_tee_del_backward(self):
         forward, backward = tee(repeat(None, 20000000))
diff --git a/Modules/itertoolsmodule.c b/Modules/itertoolsmodule.c
index d377c2c57006aa..44b92f8dcffe4d 100644
--- a/Modules/itertoolsmodule.c
+++ b/Modules/itertoolsmodule.c
@@ -815,10 +815,9 @@ teedataobject_traverse(teedataobject *tdo, visitproc 
visit, void * arg)
 }
 
 static void
-teedataobject_safe_decref(PyObject *obj, PyTypeObject *tdo_type)
+teedataobject_safe_decref(PyObject *obj)
 {
-    while (obj && Py_IS_TYPE(obj, tdo_type) &&
-           Py_REFCNT(obj) == 1) {
+    while (obj && Py_REFCNT(obj) == 1) {
         PyObject *nextlink = ((teedataobject *)obj)->nextlink;
         ((teedataobject *)obj)->nextlink = NULL;
         Py_SETREF(obj, nextlink);
@@ -837,8 +836,7 @@ teedataobject_clear(teedataobject *tdo)
         Py_CLEAR(tdo->values[i]);
     tmp = tdo->nextlink;
     tdo->nextlink = NULL;
-    itertools_state *state = get_module_state_by_cls(Py_TYPE(tdo));
-    teedataobject_safe_decref(tmp, state->teedataobject_type);
+    teedataobject_safe_decref(tmp);
     return 0;
 }
 

_______________________________________________
Python-checkins mailing list -- python-checkins@python.org
To unsubscribe send an email to python-checkins-le...@python.org
https://mail.python.org/mailman3/lists/python-checkins.python.org/
Member address: arch...@mail-archive.com