[Python-checkins] [3.12] gh-115874: Don't use module state in teedataobject tp_dealloc (GH-116204) (#116955)

[erlend-aasland]

https://github.com/python/cpython/commit/1c0c6c91afcb765f30bbb4e3d80a50e31d7adfcc
commit: 1c0c6c91afcb765f30bbb4e3d80a50e31d7adfcc
branch: 3.12
author: Miss Islington (bot) <31488909+miss-isling...@users.noreply.github.com>
committer: erlend-aasland <erlend.aasl...@protonmail.com>
date: 2024-03-18T12:40:34Z
summary:

[3.12] gh-115874: Don't use module state in teedataobject tp_dealloc 
(GH-116204) (#116955)

(cherry picked from commit e2fcaf19d302b05d3466807bad0a61f39db2a51b)

Co-authored-by: Erlend E. Aasland <erl...@python.org>
Co-authored-by: Brandt Bucher <brandtbuc...@microsoft.com>

files:
M Lib/test/test_itertools.py
M Modules/itertoolsmodule.c

diff --git a/Lib/test/test_itertools.py b/Lib/test/test_itertools.py
index 705e880d98685e..3d20e70fc1b63f 100644
--- a/Lib/test/test_itertools.py
+++ b/Lib/test/test_itertools.py
@@ -1,7 +1,7 @@
 import doctest
 import unittest
 from test import support
-from test.support import threading_helper
+from test.support import threading_helper, script_helper
 from itertools import *
 import weakref
 from decimal import Decimal
@@ -1695,6 +1695,14 @@ def test_tee(self):
             self.pickletest(proto, a, compare=ans)
             self.pickletest(proto, b, compare=ans)
 
+    def test_tee_dealloc_segfault(self):
+        # gh-115874: segfaults when accessing module state in tp_dealloc.
+        script = (
+            "import typing, copyreg, itertools; "
+            "copyreg.buggy_tee = itertools.tee(())"
+        )
+        script_helper.assert_python_ok("-c", script)
+
     # Issue 13454: Crash when deleting backward iterator from tee()
     def test_tee_del_backward(self):
         forward, backward = tee(repeat(None, 20000000))
diff --git a/Modules/itertoolsmodule.c b/Modules/itertoolsmodule.c
index a8eee723bd46cc..d42f9dd0768658 100644
--- a/Modules/itertoolsmodule.c
+++ b/Modules/itertoolsmodule.c
@@ -810,10 +810,9 @@ teedataobject_traverse(teedataobject *tdo, visitproc 
visit, void * arg)
 }
 
 static void
-teedataobject_safe_decref(PyObject *obj, PyTypeObject *tdo_type)
+teedataobject_safe_decref(PyObject *obj)
 {
-    while (obj && Py_IS_TYPE(obj, tdo_type) &&
-           Py_REFCNT(obj) == 1) {
+    while (obj && Py_REFCNT(obj) == 1) {
         PyObject *nextlink = ((teedataobject *)obj)->nextlink;
         ((teedataobject *)obj)->nextlink = NULL;
         Py_SETREF(obj, nextlink);
@@ -832,8 +831,7 @@ teedataobject_clear(teedataobject *tdo)
         Py_CLEAR(tdo->values[i]);
     tmp = tdo->nextlink;
     tdo->nextlink = NULL;
-    itertools_state *state = get_module_state_by_cls(Py_TYPE(tdo));
-    teedataobject_safe_decref(tmp, state->teedataobject_type);
+    teedataobject_safe_decref(tmp);
     return 0;
 }
 

_______________________________________________
Python-checkins mailing list -- python-checkins@python.org
To unsubscribe send an email to python-checkins-le...@python.org
https://mail.python.org/mailman3/lists/python-checkins.python.org/
Member address: arch...@mail-archive.com