From: Thomas Kowalski <thom.kowa@gmail.com>
Date: Thu, 12 Mar 2026 13:27:07 +0000 (+0100)
Subject: gh-145681: do not deallocate list buffer in `_PyList_AsTupleAndClear` (GH-145680)
X-Git-Tag: v3.15.0a8~340
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7836ecc5daf541061de2072070f7371d41b009ee;p=thirdparty%2FPython%2Fcpython.git

gh-145681: do not deallocate list buffer in `_PyList_AsTupleAndClear` (GH-145680)

Setting the size to 0 turns the list contents into overallocated memory that the deallocator will free.
Ownership is transferred to the new tuple so no refcount adjustment is needed.
---

diff --git a/Objects/listobject.c b/Objects/listobject.c
index 1fcedd3a28c9..1cc62764e2fd 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -3283,10 +3283,8 @@ _PyList_AsTupleAndClear(PyListObject *self)
     Py_BEGIN_CRITICAL_SECTION(self);
     PyObject **items = self->ob_item;
     Py_ssize_t size = Py_SIZE(self);
-    self->ob_item = NULL;
     Py_SET_SIZE(self, 0);
     ret = _PyTuple_FromArraySteal(items, size);
-    free_list_items(items, false);
     Py_END_CRITICAL_SECTION();
     return ret;
 }