Stowage/cpython
2
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2026-04-14 07:41:00 +00:00
Code Issues Projects Releases Packages Wiki Activity

[3.14] gh-142829: Fix use-after-free in Context.__eq__ via re-entrant ContextVar.set (GH-142905) (#143627)

Browse source 
gh-142829: Fix use-after-free in `Context.__eq__` via re-entrant `ContextVar.set` (GH-142905)
(cherry picked from commit a4086d7f89)

Co-authored-by: A.Ibrahim <abdulrasheedibrahim47@gmail.com>
This commit is contained in:
Miss Islington (bot) 2026-01-10 07:51:37 +01:00 • committed by GitHub
parent fca010da50
commit 16efe85129
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 55 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

27
Python/hamt.c
View file

@ -2328,6 +2328,10 @@ _PyHamt_Eq(PyHamtObject *v, PyHamtObject *w)
return 0;
}
Py_INCREF(v);
Py_INCREF(w);
int res = 1;
PyHamtIteratorState iter;
hamt_iter_t iter_res;
hamt_find_t find_res;
@ -2343,25 +2347,38 @@ _PyHamt_Eq(PyHamtObject *v, PyHamtObject *w)
find_res = hamt_find(w, v_key, &w_val);
switch (find_res) {
case F_ERROR:
return -1;
res = -1;
goto done;
case F_NOT_FOUND:
return 0;
res = 0;
goto done;
case F_FOUND: {
Py_INCREF(v_key);
Py_INCREF(v_val);
Py_INCREF(w_val);
int cmp = PyObject_RichCompareBool(v_val, w_val, Py_EQ);
Py_DECREF(v_key);
Py_DECREF(v_val);
Py_DECREF(w_val);
if (cmp < 0) {
return -1;
res = -1;
goto done;
}
if (cmp == 0) {
return 0;
res = 0;
goto done;
}
}
}
}
} while (iter_res != I_END);
return 1;
done:
Py_DECREF(v);
Py_DECREF(w);
return res;
}
Py_ssize_t