cpython/Modules/_io
Miss Islington (bot) f264f103d4
[3.14] gh-143378: Fix use-after-free when BytesIO is concurrently mutated during write operations (GH-143408) (GH-143599)
PyObject_GetBuffer() can execute user code (e.g. via __buffer__), which may
close or otherwise mutate a BytesIO object while write() or writelines()
is in progress. This could invalidate the internal buffer and lead to a
use-after-free.

Ensure that PyObject_GetBuffer() is called before validation checks.
(cherry picked from commit 6d54b6ac7d)

Co-authored-by: zhong <60600792+superboy-zjc@users.noreply.github.com>
2026-01-09 12:16:51 +00:00
..
clinic [3.14] gh-132551: make io.BytesIO thread safe (GH-132616) (#138551) 2025-10-07 23:48:28 +05:30
_iomodule.c gh-132952: Speed up startup by importing _io instead of io (#132957) 2025-04-28 08:38:56 -07:00
_iomodule.h gh-117151: IO performance improvement, increase io.DEFAULT_BUFFER_SIZE to 128k (GH-118144) 2025-03-07 11:36:12 -08:00
bufferedio.c [3.14] gh-135607: remove null checking of weakref list in dealloc of extension modules and objects (#135614) (#136119) 2025-06-30 15:59:22 +02:00
bytesio.c [3.14] gh-143378: Fix use-after-free when BytesIO is concurrently mutated during write operations (GH-143408) (GH-143599) 2026-01-09 12:16:51 +00:00
fileio.c [3.14] gh-135607: remove null checking of weakref list in dealloc of extension modules and objects (#135614) (#136119) 2025-06-30 15:59:22 +02:00
iobase.c [3.14] gh-140607: Validate returned byte count in RawIOBase.read (GH-140611) (#140728) 2025-10-29 13:31:48 +01:00
stringio.c [3.14] gh-135607: remove null checking of weakref list in dealloc of extension modules and objects (#135614) (#136119) 2025-06-30 15:59:22 +02:00
textio.c [3.14] gh-142594: fix by property calls io.TextIOWrapper.detach (GH-142706) (GH-142755) 2025-12-16 10:55:25 +01:00
winconsoleio.c [3.14] gh-135607: remove null checking of weakref list in dealloc of extension modules and objects (#135614) (#136119) 2025-06-30 15:59:22 +02:00