[3.12] gh-115874: Don't use module state in teedataobject tp_dealloc (GH-116204)...

(cherry picked from commit e2fcaf19d302b05d3466807bad0a61f39db2a51b)

Co-authored-by: Erlend E. Aasland <erlend@python.org>
Co-authored-by: Brandt Bucher <brandtbucher@microsoft.com>

diff --git a/Lib/test/test_itertools.py b/Lib/test/test_itertools.py
index 705e880d98685e5b3523c1daabacecd4cf239e74..3d20e70fc1b63f84bea6558d870c2ea13987e3c2 100644 (file)
--- a/Lib/test/test_itertools.py
+++ b/Lib/test/test_itertools.py
@@ -1,7 +1,7 @@
 import doctest
 import unittest
 from test import support
-from test.support import threading_helper
+from test.support import threading_helper, script_helper
 from itertools import *
 import weakref
 from decimal import Decimal
@@ -1695,6 +1695,14 @@ class TestBasicOps(unittest.TestCase):
             self.pickletest(proto, a, compare=ans)
             self.pickletest(proto, b, compare=ans)
 
+    def test_tee_dealloc_segfault(self):
+        # gh-115874: segfaults when accessing module state in tp_dealloc.
+        script = (
+            "import typing, copyreg, itertools; "
+            "copyreg.buggy_tee = itertools.tee(())"
+        )
+        script_helper.assert_python_ok("-c", script)
+
     # Issue 13454: Crash when deleting backward iterator from tee()
     def test_tee_del_backward(self):
         forward, backward = tee(repeat(None, 20000000))

diff --git a/Modules/itertoolsmodule.c b/Modules/itertoolsmodule.c
index a8eee723bd46cc31ebdaf07d2be54651a08f2f77..d42f9dd07686584d5b35b38d42a3671d87550c99 100644 (file)
--- a/Modules/itertoolsmodule.c
+++ b/Modules/itertoolsmodule.c
@@ -810,10 +810,9 @@ teedataobject_traverse(teedataobject *tdo, visitproc visit, void * arg)
 }
 
 static void
-teedataobject_safe_decref(PyObject *obj, PyTypeObject *tdo_type)
+teedataobject_safe_decref(PyObject *obj)
 {
-    while (obj && Py_IS_TYPE(obj, tdo_type) &&
-           Py_REFCNT(obj) == 1) {
+    while (obj && Py_REFCNT(obj) == 1) {
         PyObject *nextlink = ((teedataobject *)obj)->nextlink;
         ((teedataobject *)obj)->nextlink = NULL;
         Py_SETREF(obj, nextlink);
@@ -832,8 +831,7 @@ teedataobject_clear(teedataobject *tdo)
         Py_CLEAR(tdo->values[i]);
     tmp = tdo->nextlink;
     tdo->nextlink = NULL;
-    itertools_state *state = get_module_state_by_cls(Py_TYPE(tdo));
-    teedataobject_safe_decref(tmp, state->teedataobject_type);
+    teedataobject_safe_decref(tmp);
     return 0;
 }