]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
gh-143378: Fix use-after-free when BytesIO is concurrently mutated during write opera...
authorzhong <60600792+superboy-zjc@users.noreply.github.com>
Fri, 9 Jan 2026 11:50:56 +0000 (03:50 -0800)
committerGitHub <noreply@github.com>
Fri, 9 Jan 2026 11:50:56 +0000 (13:50 +0200)
commit6d54b6ac7d5744e1f59d784c8e020d632d2959a3
treeb9b0fdb8d69376546844ffcb4bf013f5426cc1fa
parentdcdb23f9db2bd683e5d37558f09b458be25a9b4d
gh-143378: Fix use-after-free when BytesIO is concurrently mutated during write operations (GH-143408)

PyObject_GetBuffer() can execute user code (e.g. via __buffer__), which may
close or otherwise mutate a BytesIO object while write() or writelines()
is in progress. This could invalidate the internal buffer and lead to a
use-after-free.

Ensure that PyObject_GetBuffer() is called before validation checks.
Lib/_pyio.py
Lib/test/test_io/test_memoryio.py
Misc/NEWS.d/next/Library/2026-01-03-19-41-36.gh-issue-143378.29AvE7.rst [new file with mode: 0644]
Modules/_io/bytesio.c