[3.13] gh-118561: Fix crash involving list.extend in free-threaded build (GH-118723) (#118863)

The `list_preallocate_exact` function did not zero initialize array
contents. In the free-threaded build, this could expose uninitialized
memory to concurrent readers between the call to
`list_preallocate_exact` and the filling of the array contents with
items.
(cherry picked from commit 2402715e10)

Co-authored-by: Sam Gross <colesbury@gmail.com>
This commit is contained in:
Miss Islington (bot) 2024-05-09 21:14:47 +02:00 committed by GitHub
parent 098eec9a15
commit 846cfb9a67
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 4 additions and 1 deletions

View File

@ -0,0 +1,2 @@
Fix race condition in free-threaded build where :meth:`list.extend` could expose
uninitialied memory to concurrent readers.

View File

@ -192,6 +192,7 @@ list_preallocate_exact(PyListObject *self, Py_ssize_t size)
return -1;
}
items = array->ob_item;
memset(items, 0, size * sizeof(PyObject *));
#else
items = PyMem_New(PyObject*, size);
if (items == NULL) {
@ -199,7 +200,7 @@ list_preallocate_exact(PyListObject *self, Py_ssize_t size)
return -1;
}
#endif
self->ob_item = items;
FT_ATOMIC_STORE_PTR_RELEASE(self->ob_item, items);
self->allocated = size;
return 0;
}