Skip to content

Commit 194671b

Browse files
erlend-aaslandbrandtbucher
authored andcommitted
pythongh-115874: Don't use module state in teedataobject tp_dealloc (python#116204)
Co-authored-by: Brandt Bucher <[email protected]>
1 parent f736c19 commit 194671b

File tree

2 files changed

+12
-6
lines changed

2 files changed

+12
-6
lines changed

Lib/test/test_itertools.py

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
import doctest
22
import unittest
33
from test import support
4-
from test.support import threading_helper
4+
from test.support import threading_helper, script_helper
55
from itertools import *
66
import weakref
77
from decimal import Decimal
@@ -1699,6 +1699,14 @@ def test_tee(self):
16991699
self.pickletest(proto, a, compare=ans)
17001700
self.pickletest(proto, b, compare=ans)
17011701

1702+
def test_tee_dealloc_segfault(self):
1703+
# gh-115874: segfaults when accessing module state in tp_dealloc.
1704+
script = (
1705+
"import typing, copyreg, itertools; "
1706+
"copyreg.buggy_tee = itertools.tee(())"
1707+
)
1708+
script_helper.assert_python_ok("-c", script)
1709+
17021710
# Issue 13454: Crash when deleting backward iterator from tee()
17031711
def test_tee_del_backward(self):
17041712
forward, backward = tee(repeat(None, 20000000))

Modules/itertoolsmodule.c

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -815,10 +815,9 @@ teedataobject_traverse(teedataobject *tdo, visitproc visit, void * arg)
815815
}
816816

817817
static void
818-
teedataobject_safe_decref(PyObject *obj, PyTypeObject *tdo_type)
818+
teedataobject_safe_decref(PyObject *obj)
819819
{
820-
while (obj && Py_IS_TYPE(obj, tdo_type) &&
821-
Py_REFCNT(obj) == 1) {
820+
while (obj && Py_REFCNT(obj) == 1) {
822821
PyObject *nextlink = ((teedataobject *)obj)->nextlink;
823822
((teedataobject *)obj)->nextlink = NULL;
824823
Py_SETREF(obj, nextlink);
@@ -837,8 +836,7 @@ teedataobject_clear(teedataobject *tdo)
837836
Py_CLEAR(tdo->values[i]);
838837
tmp = tdo->nextlink;
839838
tdo->nextlink = NULL;
840-
itertools_state *state = get_module_state_by_cls(Py_TYPE(tdo));
841-
teedataobject_safe_decref(tmp, state->teedataobject_type);
839+
teedataobject_safe_decref(tmp);
842840
return 0;
843841
}
844842

0 commit comments

Comments
 (0)