From b13b84ab707bbc06b26a1ed4fb58253ff309c5dd Mon Sep 17 00:00:00 2001 From: "Miss Islington (bot)" <31488909+miss-islington@users.noreply.github.com> Date: Tue, 12 Nov 2024 14:04:25 +0100 Subject: [PATCH] [3.12] gh-126405: fix use-after-free in `_asyncio.Future.remove_done_callback` (GH-126733) (#126737) gh-126405: fix use-after-free in `_asyncio.Future.remove_done_callback` (GH-126733) (cherry picked from commit 37c57dfad12744608091653fd753a1f770e2479b) Co-authored-by: Kumar Aditya --- Modules/_asynciomodule.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Modules/_asynciomodule.c b/Modules/_asynciomodule.c index 20a9d992834b..2356b708ee88 100644 --- a/Modules/_asynciomodule.c +++ b/Modules/_asynciomodule.c @@ -1073,8 +1073,10 @@ _asyncio_Future_remove_done_callback_impl(FutureObj *self, PyTypeObject *cls, if (len == 1) { PyObject *cb_tup = PyList_GET_ITEM(self->fut_callbacks, 0); + Py_INCREF(cb_tup); int cmp = PyObject_RichCompareBool( PyTuple_GET_ITEM(cb_tup, 0), fn, Py_EQ); + Py_DECREF(cb_tup); if (cmp == -1) { return NULL; } -- 2.47.3