Stowage/cpython
2
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2026-01-18 21:30:02 +00:00
Code Issues Projects Releases Packages Wiki Activity

[3.13] gh-142829: Fix use-after-free in Context.__eq__ via re-entrant ContextVar.set (GH-142905) (GH-143871)

Browse source 
(cherry picked from commit a4086d7f89)

Co-authored-by: A.Ibrahim <abdulrasheedibrahim47@gmail.com>
This commit is contained in:
Serhiy Storchaka 2026-01-15 17:00:44 +02:00 • committed by GitHub
parent 343b5c4421
commit 149ecbb9a9
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 55 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

27
Python/hamt.c
View file

@ -2368,6 +2368,10 @@ _PyHamt_Eq(PyHamtObject *v, PyHamtObject *w)
return 0;
}
Py_INCREF(v);
Py_INCREF(w);
int res = 1;
PyHamtIteratorState iter;
hamt_iter_t iter_res;
hamt_find_t find_res;
@ -2383,25 +2387,38 @@ _PyHamt_Eq(PyHamtObject *v, PyHamtObject *w)
find_res = hamt_find(w, v_key, &w_val);
switch (find_res) {
case F_ERROR:
return -1;
res = -1;
goto done;
case F_NOT_FOUND:
return 0;
res = 0;
goto done;
case F_FOUND: {
Py_INCREF(v_key);
Py_INCREF(v_val);
Py_INCREF(w_val);
int cmp = PyObject_RichCompareBool(v_val, w_val, Py_EQ);
Py_DECREF(v_key);
Py_DECREF(v_val);
Py_DECREF(w_val);
if (cmp < 0) {
return -1;
res = -1;
goto done;
}
if (cmp == 0) {
return 0;
res = 0;
goto done;
}
}
}
}
} while (iter_res != I_END);
return 1;
done:
Py_DECREF(v);
Py_DECREF(w);
return res;
}
Py_ssize_t