fix: use-after-free in get_data_from_buffer

msgpack/_unpacker.pyx

@@ -130,9 +130,7 @@ cdef inline int get_data_from_buffer(object obj,
         # create a contiguous copy and get buffer
         contiguous = PyMemoryView_GetContiguous(obj, PyBUF_READ, b'C')
         PyObject_GetBuffer(contiguous, view, PyBUF_SIMPLE)
-        # view must hold the only reference to contiguous,
-        # so memory is freed when view is released
-        Py_DECREF(contiguous)
+
     buffer_len[0] = view.len
     buf[0] = <char*> view.buf
     return 1

msgpack/fallback.py

@@ -328,7 +328,8 @@ class Unpacker:
             self._buf_checkpoint = 0
 
         # Use extend here: INPLACE_ADD += doesn't reliably typecast memoryview in jython
-        self._buffer.extend(view)
+        # tobytes ensures compatibility with non-contiguous memoryviews
+        self._buffer.extend(view.tobytes())
         view.release()
 
     def _consume(self):