https://github.com/python/cpython/commit/e8fb088dbaa71dd5f0146b2f4a8f7ecbe2ce9625
commit: e8fb088dbaa71dd5f0146b2f4a8f7ecbe2ce9625
branch: 3.13
author: Peter Bierma <[email protected]>
committer: kumaraditya303 <[email protected]>
date: 2024-08-09T19:36:36+05:30
summary:
[3.13] gh-122695: Fix double-free when using `gc.get_referents` with a freed
`_asyncio.FutureIter` (#122837)
* Backport #122834 for 3.13
files:
A Misc/NEWS.d/next/Library/2024-08-08-15-05-58.gh-issue-122695.f7pwBv.rst
M Lib/test/test_asyncio/test_futures.py
M Modules/_asynciomodule.c
diff --git a/Lib/test/test_asyncio/test_futures.py
b/Lib/test/test_asyncio/test_futures.py
index 458b70451a306a..2417712a9c9b64 100644
--- a/Lib/test/test_asyncio/test_futures.py
+++ b/Lib/test/test_asyncio/test_futures.py
@@ -675,6 +675,14 @@ def test_future_del_segfault(self):
with self.assertRaises(AttributeError):
del fut._log_traceback
+ def test_future_iter_get_referents_segfault(self):
+ # See https://github.com/python/cpython/issues/122695
+ import _asyncio
+ it = iter(self._new_future(loop=self.loop))
+ del it
+ evil = gc.get_referents(_asyncio)
+ gc.collect()
+
@unittest.skipUnless(hasattr(futures, '_CFuture'),
'requires the C _asyncio module')
diff --git
a/Misc/NEWS.d/next/Library/2024-08-08-15-05-58.gh-issue-122695.f7pwBv.rst
b/Misc/NEWS.d/next/Library/2024-08-08-15-05-58.gh-issue-122695.f7pwBv.rst
new file mode 100644
index 00000000000000..cc6bc38f419462
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2024-08-08-15-05-58.gh-issue-122695.f7pwBv.rst
@@ -0,0 +1,2 @@
+Fixed double-free when using :func:`gc.get_referents` with a freed
+:class:`asyncio.Future` iterator.
diff --git a/Modules/_asynciomodule.c b/Modules/_asynciomodule.c
index 6e87de5e954826..3babd33eaabf45 100644
--- a/Modules/_asynciomodule.c
+++ b/Modules/_asynciomodule.c
@@ -3529,17 +3529,6 @@ module_traverse(PyObject *mod, visitproc visit, void
*arg)
Py_VISIT(state->iscoroutine_typecache);
Py_VISIT(state->context_kwname);
-
-#ifndef Py_GIL_DISABLED
- // Visit freelist.
- PyObject *next = (PyObject*) state->fi_freelist;
- while (next != NULL) {
- PyObject *current = next;
- Py_VISIT(current);
- next = (PyObject*) ((futureiterobject*) current)->future;
- }
-#endif
-
return 0;
}
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3/lists/python-checkins.python.org/
Member address: [email protected]
