Mirror
/
cpython
mirror of https://github.com/python/cpython
4
1
Fork 0
Code Issues Releases Wiki Activity

gh-118561: Fix crash involving list.extend in free-threaded build (#118723) 

The `list_preallocate_exact` function did not zero initialize array
contents. In the free-threaded build, this could expose uninitialized
memory to concurrent readers between the call to
`list_preallocate_exact` and the filling of the array contents with
items.
This commit is contained in:
Sam Gross 2024-05-09 14:52:27 -04:00 committed by GitHub
parent 82abe75e77
commit 2402715e10
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Misc/NEWS.d/next/Core and Builtins/2024-05-07-16-57-56.gh-issue-118561.wNMKVd.rst Normal file
View File

@ -0,0 +1,2 @@
Fix race condition in free-threaded build where :meth:`list.extend` could expose
uninitialied memory to concurrent readers.

3
Objects/listobject.c
View File

@ -192,6 +192,7 @@ list_preallocate_exact(PyListObject *self, Py_ssize_t size)
return -1; return -1;
} }
items = array->ob_item; items = array->ob_item;
memset(items, 0, size * sizeof(PyObject *));
#else #else
items = PyMem_New(PyObject*, size); items = PyMem_New(PyObject*, size);
if (items == NULL) { if (items == NULL) {
@ -199,7 +200,7 @@ list_preallocate_exact(PyListObject *self, Py_ssize_t size)
return -1; return -1;
} }
#endif #endif
self->ob_item = items; FT_ATOMIC_STORE_PTR_RELEASE(self->ob_item, items);
self->allocated = size; self->allocated = size;
return 0; return 0;
} }