[3.11] gh-115243: Fix crash in deque.index() when the deque is concurrently modified...

(cherry picked from commit 671360161f0b7a5ff4c1d062e570962e851b4bde)

Co-authored-by: kcatss <kcats9731@gmail.com>

diff --git a/Lib/test/test_deque.py b/Lib/test/test_deque.py
index ae1dfacd7262e404b102bd47a62c8f3bbc483bc1..4679f297fd7f4a134c12552b96671f4a7e4f6b10 100644 (file)
--- a/Lib/test/test_deque.py
+++ b/Lib/test/test_deque.py
@@ -166,7 +166,7 @@ class TestBasic(unittest.TestCase):
         with self.assertRaises(RuntimeError):
             n in d
 
-    def test_contains_count_stop_crashes(self):
+    def test_contains_count_index_stop_crashes(self):
         class A:
             def __eq__(self, other):
                 d.clear()
@@ -178,6 +178,10 @@ class TestBasic(unittest.TestCase):
         with self.assertRaises(RuntimeError):
             _ = d.count(3)
 
+        d = deque([A()])
+        with self.assertRaises(RuntimeError):
+            d.index(0)
+
     def test_extend(self):
         d = deque('a')
         self.assertRaises(TypeError, d.extend, 1)

diff --git a/Misc/NEWS.d/next/Security/2024-02-12-00-33-01.gh-issue-115243.e1oGX8.rst b/Misc/NEWS.d/next/Security/2024-02-12-00-33-01.gh-issue-115243.e1oGX8.rst
new file mode 100644 (file)
index 0000000..ae0e910
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2024-02-12-00-33-01.gh-issue-115243.e1oGX8.rst
@@ -0,0 +1 @@
+Fix possible crashes in :meth:`collections.deque.index` when the deque is concurrently modified.

diff --git a/Modules/_collectionsmodule.c b/Modules/_collectionsmodule.c
index 5f5c0886e2f65ea39e5ce557d9faaed59d5b6bb0..900d90650164538aa87a6c982033265af3127b7c 100644 (file)
--- a/Modules/_collectionsmodule.c
+++ b/Modules/_collectionsmodule.c
@@ -1084,8 +1084,9 @@ deque_index(dequeobject *deque, PyObject *const *args, Py_ssize_t nargs)
     n = stop - i;
     while (--n >= 0) {
         CHECK_NOT_END(b);
-        item = b->data[index];
+        item = Py_NewRef(b->data[index]);
         cmp = PyObject_RichCompareBool(item, v, Py_EQ);
+        Py_DECREF(item);
         if (cmp > 0)
             return PyLong_FromSsize_t(stop - n - 1);
         if (cmp < 0)