]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
[3.13] gh-143378: Fix use-after-free when BytesIO is concurrently mutated during...
authorSerhiy Storchaka <storchaka@gmail.com>
Mon, 12 Jan 2026 08:37:28 +0000 (10:37 +0200)
committerGitHub <noreply@github.com>
Mon, 12 Jan 2026 08:37:28 +0000 (10:37 +0200)
commitdcc6117628da72f41d877418a8ae8f1723546043
tree87cad90bea1abc662be9d0965699534849450e4b
parentea1ecf6504f4dd9e9eecc401c2d2242140cab0cd
[3.13] gh-143378: Fix use-after-free when BytesIO is concurrently mutated during write operations (GH-143408) (GH-143600)

PyObject_GetBuffer() can execute user code (e.g. via __buffer__), which may
close or otherwise mutate a BytesIO object while write() or writelines()
is in progress. This could invalidate the internal buffer and lead to a
use-after-free.

Ensure that PyObject_GetBuffer() is called before validation checks.
(cherry picked from commit 6d54b6ac7d5744e1f59d784c8e020d632d2959a3)

Co-authored-by: zhong <60600792+superboy-zjc@users.noreply.github.com>
Lib/_pyio.py
Lib/test/test_memoryio.py
Misc/NEWS.d/next/Library/2026-01-03-19-41-36.gh-issue-143378.29AvE7.rst [new file with mode: 0644]
Modules/_io/bytesio.c