]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
[3.15] gh-143988: Fix re-entrant mutation crashes in socket sendmsg/recvmsg_into...
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Wed, 10 Jun 2026 14:25:33 +0000 (16:25 +0200)
committerGitHub <noreply@github.com>
Wed, 10 Jun 2026 14:25:33 +0000 (14:25 +0000)
commit9261f8b5888e37f9072f046816a1b00ce8dbc4ea
tree13dc3206680a6e94f849d233e8ec364689f985f9
parent637746d6fc9de2c07cf532ffe84ba270398ca8d5
[3.15] gh-143988: Fix re-entrant mutation crashes in socket sendmsg/recvmsg_into (GH-143987) (#151246)

gh-143988: Fix re-entrant mutation crashes in socket sendmsg/recvmsg_into (GH-143987)

Fix crashes in socket.sendmsg() and socket.recvmsg_into() that could
occur if buffer sequences are mutated re-entrantly during argument
parsing via __buffer__ protocol callbacks.

The bug occurs because:

1. PySequence_Fast() returns the original list object when the input
   is already a list (not a copy).
2. During iteration, PyObject_GetBuffer() triggers __buffer__
   callbacks which may clear the list.
3. Subsequent iterations access invalid memory (heap OOB read).

The fix replaces PySequence_Fast() with PySequence_Tuple() which
always creates a new tuple, ensuring the sequence cannot be mutated
during iteration.
(cherry picked from commit 896f7fdc7d0ba6d4ace06935b9d67c4da0f9ecbe)

Co-authored-by: tonghuaroot (童话) <tonghuaroot@gmail.com>
Co-authored-by: tonghuaroot <23011166+tonghuaroot@users.noreply.github.com>
Lib/test/test_socket.py
Misc/NEWS.d/next/Library/2026-01-18-06-42-47.gh-issue-143988.MtLtCP.rst [new file with mode: 0644]
Modules/socketmodule.c