Mirror
/
cpython
mirror of https://github.com/python/cpython
4
1
Fork 0
Code Issues Releases Wiki Activity

[3.13] gh-122695: Fix double-free when using `gc.get_referents` with a freed `_asyncio.FutureIter` (#122837) 

* Backport #122834 for 3.13
This commit is contained in:
Peter Bierma 2024-08-09 14:06:36 +00:00 committed by GitHub
parent 60c44ed975
commit e8fb088dba
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 10 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Lib/test/test_asyncio/test_futures.py
View File

@ -675,6 +675,14 @@ class CFutureTests(BaseFutureTests, test_utils.TestCase):
with self.assertRaises(AttributeError):
del fut._log_traceback
def test_future_iter_get_referents_segfault(self):
# See https://github.com/python/cpython/issues/122695
import _asyncio
it = iter(self._new_future(loop=self.loop))
del it
evil = gc.get_referents(_asyncio)
gc.collect()
@unittest.skipUnless(hasattr(futures, '_CFuture'),
'requires the C _asyncio module')

2
Misc/NEWS.d/next/Library/2024-08-08-15-05-58.gh-issue-122695.f7pwBv.rst Normal file
View File

@ -0,0 +1,2 @@
Fixed double-free when using :func:`gc.get_referents` with a freed
:class:`asyncio.Future` iterator.

11
Modules/_asynciomodule.c
View File

@ -3529,17 +3529,6 @@ module_traverse(PyObject *mod, visitproc visit, void *arg)
Py_VISIT(state->iscoroutine_typecache);
Py_VISIT(state->context_kwname);
#ifndef Py_GIL_DISABLED
// Visit freelist.
PyObject *next = (PyObject*) state->fi_freelist;
while (next != NULL) {
PyObject *current = next;
Py_VISIT(current);
next = (PyObject*) ((futureiterobject*) current)->future;
}
#endif
return 0;
}