]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
gh-153570: Fix use-after-free in bytearray.take_bytes() with a reentrant __index__...
authortonghuaroot (童话) <tonghuaroot@gmail.com>
Fri, 24 Jul 2026 10:15:01 +0000 (18:15 +0800)
committerGitHub <noreply@github.com>
Fri, 24 Jul 2026 10:15:01 +0000 (10:15 +0000)
commitee21d992d6117eb7f0c6087ecb93d90cd0ed610c
tree2ab0197eb198892e03ae09dee0d2959efb184170
parent0d71cc460f5ac82566d63664dcc74d0ec503c7c2
gh-153570: Fix use-after-free in bytearray.take_bytes() with a reentrant __index__ (#153572)

bytearray.take_bytes() cached the size before the argument's __index__ call and
used it for the bounds check and the buffer reads, so an __index__ that resizes
the bytearray left it reading freed memory. Re-read the size after __index__,
matching bytearray.__setitem__ (GH-91153).
Lib/test/test_bytes.py
Misc/NEWS.d/next/Core_and_Builtins/2026-07-11-15-30-00.gh-issue-153570.Kb7Xd2.rst [new file with mode: 0644]
Objects/bytearrayobject.c