From 06a1b8915d6674e40f0dccc422ca2c06212392d8 Mon Sep 17 00:00:00 2001 From: Ammar Askar Date: Fri, 22 May 2020 16:10:55 +0000 Subject: [PATCH] bpo-40705: Fix use-after-free in _zoneinfo's module_free (GH-20280) --- Modules/_zoneinfo.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/Modules/_zoneinfo.c b/Modules/_zoneinfo.c index d7e71576576..d852c763e2e 100644 --- a/Modules/_zoneinfo.c +++ b/Modules/_zoneinfo.c @@ -2490,6 +2490,7 @@ new_weak_cache() static int initialize_caches() { + // TODO: Move to a PyModule_GetState / PEP 573 based caching system. if (TIMEDELTA_CACHE == NULL) { TIMEDELTA_CACHE = PyDict_New(); } @@ -2603,14 +2604,16 @@ module_free() xdecref_ttinfo(&NO_TTINFO); - Py_XDECREF(TIMEDELTA_CACHE); - if (!Py_REFCNT(TIMEDELTA_CACHE)) { - TIMEDELTA_CACHE = NULL; + if (TIMEDELTA_CACHE != NULL && Py_REFCNT(TIMEDELTA_CACHE) > 1) { + Py_DECREF(TIMEDELTA_CACHE); + } else { + Py_CLEAR(TIMEDELTA_CACHE); } - Py_XDECREF(ZONEINFO_WEAK_CACHE); - if (!Py_REFCNT(ZONEINFO_WEAK_CACHE)) { - ZONEINFO_WEAK_CACHE = NULL; + if (ZONEINFO_WEAK_CACHE != NULL && Py_REFCNT(ZONEINFO_WEAK_CACHE) > 1) { + Py_DECREF(ZONEINFO_WEAK_CACHE); + } else { + Py_CLEAR(ZONEINFO_WEAK_CACHE); } strong_cache_free(ZONEINFO_STRONG_CACHE);