https://github.com/python/cpython/commit/bff005123119d5a010774f5dc9a181029024c2ac
commit: bff005123119d5a010774f5dc9a181029024c2ac
branch: main
author: Rishit Agnihotri <[email protected]>
committer: kumaraditya303 <[email protected]>
date: 2026-07-25T14:05:25+05:30
summary:
gh-153296: Fix thread-safety data race in io.StringIO iterator (#153368)
files:
A Misc/NEWS.d/next/Library/2026-07-08-15-26-00.gh-issue-153296.Twix12.rst
M Modules/_io/stringio.c
diff --git
a/Misc/NEWS.d/next/Library/2026-07-08-15-26-00.gh-issue-153296.Twix12.rst
b/Misc/NEWS.d/next/Library/2026-07-08-15-26-00.gh-issue-153296.Twix12.rst
new file mode 100644
index 000000000000000..22604dd31dd6050
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-07-08-15-26-00.gh-issue-153296.Twix12.rst
@@ -0,0 +1 @@
+Fix a data race and use-after-free when iterating over an :class:`io.StringIO`
object while it is being concurrently mutated. The ``__next__`` method now
properly acquires the object's lock.
diff --git a/Modules/_io/stringio.c b/Modules/_io/stringio.c
index b8601383ad0a26f..27605b4c44239e9 100644
--- a/Modules/_io/stringio.c
+++ b/Modules/_io/stringio.c
@@ -407,8 +407,10 @@ _io_StringIO_readline_impl(stringio *self, Py_ssize_t size)
}
static PyObject *
-stringio_iternext(PyObject *op)
+stringio_iternext_lock_held(PyObject *op)
{
+ _Py_CRITICAL_SECTION_ASSERT_OBJECT_LOCKED(op);
+
PyObject *line;
stringio *self = stringio_CAST(op);
@@ -444,6 +446,16 @@ stringio_iternext(PyObject *op)
return line;
}
+static PyObject *
+stringio_iternext(PyObject *op)
+{
+ PyObject *ret;
+ Py_BEGIN_CRITICAL_SECTION(op);
+ ret = stringio_iternext_lock_held(op);
+ Py_END_CRITICAL_SECTION();
+ return ret;
+}
+
/*[clinic input]
@critical_section
_io.StringIO.truncate
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
