diff options
| author | Kumar Aditya <kumaraditya@python.org> | 2024-11-12 12:31:34 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-11-12 12:31:34 (GMT) |
| commit | 37c57dfad12744608091653fd753a1f770e2479b (patch) | |
| tree | a2c1cb09126fe447e92717bf90aa68c78272f2f9 | |
| parent | 0ef84b0e2bf511b2cb5268a9ce64d7f2209fb3c4 (diff) | |
| download | cpython-37c57dfad12744608091653fd753a1f770e2479b.zip cpython-37c57dfad12744608091653fd753a1f770e2479b.tar.gz cpython-37c57dfad12744608091653fd753a1f770e2479b.tar.bz2 | |
gh-126405: fix use-after-free in `_asyncio.Future.remove_done_callback` (#126733)
| -rw-r--r-- | Modules/_asynciomodule.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/Modules/_asynciomodule.c b/Modules/_asynciomodule.c index 617a3dc..f883125 100644 --- a/Modules/_asynciomodule.c +++ b/Modules/_asynciomodule.c @@ -1017,8 +1017,10 @@ _asyncio_Future_remove_done_callback_impl(FutureObj *self, PyTypeObject *cls, if (len == 1) { PyObject *cb_tup = PyList_GET_ITEM(self->fut_callbacks, 0); + Py_INCREF(cb_tup); int cmp = PyObject_RichCompareBool( PyTuple_GET_ITEM(cb_tup, 0), fn, Py_EQ); + Py_DECREF(cb_tup); if (cmp == -1) { return NULL; } |