From: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Date: Tue, 12 Nov 2024 13:04:27 +0000 (+0100)
Subject: [3.13] gh-126405: fix use-after-free in `_asyncio.Future.remove_done_callback` (GH... 
X-Git-Tag: v3.13.1~124
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2da063e0b2823a770e898f2b7babe2dfc006b8d5;p=thirdparty%2FPython%2Fcpython.git

[3.13] gh-126405: fix use-after-free in `_asyncio.Future.remove_done_callback` (GH-126733) (#126736)

gh-126405: fix use-after-free in `_asyncio.Future.remove_done_callback` (GH-126733)
(cherry picked from commit 37c57dfad12744608091653fd753a1f770e2479b)

Co-authored-by: Kumar Aditya <kumaraditya@python.org>
---

diff --git a/Modules/_asynciomodule.c b/Modules/_asynciomodule.c
index 79896c6b9fdd..7e2fe2842339 100644
--- a/Modules/_asynciomodule.c
+++ b/Modules/_asynciomodule.c
@@ -994,8 +994,10 @@ _asyncio_Future_remove_done_callback_impl(FutureObj *self, PyTypeObject *cls,
 
     if (len == 1) {
         PyObject *cb_tup = PyList_GET_ITEM(self->fut_callbacks, 0);
+        Py_INCREF(cb_tup);
         int cmp = PyObject_RichCompareBool(
             PyTuple_GET_ITEM(cb_tup, 0), fn, Py_EQ);
+        Py_DECREF(cb_tup);
         if (cmp == -1) {
             return NULL;
         }