[3.13] gh-143635: Fix crash in `ga_repr_items_list` (GH-143670) (#143852)

(cherry picked from commit bdba5f0db2ab29f3deedb9416f3c143d33e4ab66)

diff --git a/Lib/test/test_genericalias.py b/Lib/test/test_genericalias.py
index 4a87e2bf7a186453efdda3d1c5dd0e2e0e9a3a95..00dc9251e0ee3bf05e4c1657b78e0e4fdc44001d 100644 (file)
--- a/Lib/test/test_genericalias.py
+++ b/Lib/test/test_genericalias.py
@@ -232,6 +232,56 @@ class BaseTest(unittest.TestCase):
         self.assertTrue(repr(MyGeneric[[]]).endswith('MyGeneric[[]]'))
         self.assertTrue(repr(MyGeneric[[int, str]]).endswith('MyGeneric[[int, str]]'))
 
+    def test_evil_repr1(self):
+        # gh-143635
+        class Zap:
+            def __init__(self, container):
+                self.container = container
+            def __getattr__(self, name):
+                if name == "__origin__":
+                    self.container.clear()
+                    return None
+                if name == "__args__":
+                    return ()
+                raise AttributeError
+
+        params = []
+        params.append(Zap(params))
+        alias = GenericAlias(list, (params,))
+        repr_str = repr(alias)
+        self.assertTrue(repr_str.startswith("list[["), repr_str)
+
+    def test_evil_repr2(self):
+        class Zap:
+            def __init__(self, container):
+                self.container = container
+            def __getattr__(self, name):
+                if name == "__qualname__":
+                    self.container.clear()
+                    return "abcd"
+                if name == "__module__":
+                    return None
+                raise AttributeError
+
+        params = []
+        params.append(Zap(params))
+        alias = GenericAlias(list, (params,))
+        repr_str = repr(alias)
+        self.assertTrue(repr_str.startswith("list[["), repr_str)
+
+    def test_evil_repr3(self):
+        # gh-143823
+        lst = []
+        class X:
+            def __repr__(self):
+                lst.clear()
+                return "x"
+
+        lst += [X(), 1]
+        ga = GenericAlias(int, lst)
+        with self.assertRaises(IndexError):
+            repr(ga)
+
     def test_exposed_type(self):
         import types
         a = types.GenericAlias(list, int)

diff --git a/Misc/NEWS.d/next/Core and Builtins/2026-01-11-20-11-36.gh-issue-143670.klnGoD.rst b/Misc/NEWS.d/next/Core and Builtins/2026-01-11-20-11-36.gh-issue-143670.klnGoD.rst
new file mode 100644 (file)
index 0000000..4ce0e71
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and Builtins/2026-01-11-20-11-36.gh-issue-143670.klnGoD.rst
@@ -0,0 +1 @@
+Fixes a crash in ``ga_repr_items_list`` function.

diff --git a/Objects/genericaliasobject.c b/Objects/genericaliasobject.c
index 4bb84f054dd3dd64d45feb59ee7c7bfa5b5c3962..8e59b3884cf529325bcf7ed5313b85eccb93a1b0 100644 (file)
--- a/Objects/genericaliasobject.c
+++ b/Objects/genericaliasobject.c
@@ -133,10 +133,15 @@ ga_repr_items_list(_PyUnicodeWriter *writer, PyObject *p)
                 return -1;
             }
         }
-        PyObject *item = PyList_GET_ITEM(p, i);
+        PyObject *item = PyList_GetItemRef(p, i);
+        if (item == NULL) {
+            return -1;  // list can be mutated in a callback
+        }
         if (ga_repr_item(writer, item) < 0) {
+            Py_DECREF(item);
             return -1;
         }
+        Py_DECREF(item);
     }
 
     if (_PyUnicodeWriter_WriteASCIIString(writer, "]", 1) < 0) {