]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
gh-142831: Fix use-after-free in json encoder during re-entrant mutation (gh-142851)
authorShamil <ashm.tech@proton.me>
Sun, 12 Apr 2026 00:14:50 +0000 (03:14 +0300)
committerGitHub <noreply@github.com>
Sun, 12 Apr 2026 00:14:50 +0000 (00:14 +0000)
commit235fa7244a0474c492ae98ee444529c7ba2a9047
tree7dcd03a0fa177cd42b6d2fa0e162a191eb5082e0
parentd761f539bdae6090817438ae65c0be8a10c9e4e3
gh-142831: Fix use-after-free in json encoder during re-entrant mutation (gh-142851)

Hold strong references to borrowed items unconditionally (not only in
free-threading builds) in _encoder_iterate_mapping_lock_held and
_encoder_iterate_fast_seq_lock_held.  User callbacks invoked during
encoding can mutate or clear the underlying container, invalidating
borrowed references.

The dict iteration path was already fixed by gh-145244.

Co-authored-by: Kumar Aditya <kumaraditya@python.org>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Lib/test/test_json/test_speedups.py
Misc/NEWS.d/next/Library/2025-12-17-04-10-35.gh-issue-142831.ee3t4L.rst [new file with mode: 0644]
Modules/_json.c