Issue #16228: Fix a crash in the json module where a list changes size while it is being encoded.

Patch by Serhiy Storchaka.

1 files changed, 3 insertions, 7 deletions

diff --git a/Modules/_json.c b/Modules/_json.c
index 2538b05..dbe3bad 100644
--- a/Modules/_json.c
+++ b/Modules/_json.c
@@ -1659,8 +1659,6 @@ encoder_listencode_list(PyEncoderObject *s, _PyAccu *acc,
     static PyObject *empty_array = NULL;
     PyObject *ident = NULL;
     PyObject *s_fast = NULL;
-    Py_ssize_t num_items;
-    PyObject **seq_items;
     Py_ssize_t i;
 
     if (open_array == NULL || close_array == NULL || empty_array == NULL) {
@@ -1674,8 +1672,7 @@ encoder_listencode_list(PyEncoderObject *s, _PyAccu *acc,
     s_fast = PySequence_Fast(seq, "_iterencode_list needs a sequence");
     if (s_fast == NULL)
         return -1;
-    num_items = PySequence_Fast_GET_SIZE(s_fast);
-    if (num_items == 0) {
+    if (PySequence_Fast_GET_SIZE(s_fast) == 0) {
         Py_DECREF(s_fast);
         return _PyAccu_Accumulate(acc, empty_array);
     }
@@ -1696,7 +1693,6 @@ encoder_listencode_list(PyEncoderObject *s, _PyAccu *acc,
         }
     }
 
-    seq_items = PySequence_Fast_ITEMS(s_fast);
     if (_PyAccu_Accumulate(acc, open_array))
         goto bail;
     if (s->indent != Py_None) {
@@ -1708,8 +1704,8 @@ encoder_listencode_list(PyEncoderObject *s, _PyAccu *acc,
             buf += newline_indent
         */
     }
-    for (i = 0; i < num_items; i++) {
-        PyObject *obj = seq_items[i];
+    for (i = 0; i < PySequence_Fast_GET_SIZE(s_fast); i++) {
+        PyObject *obj = PySequence_Fast_GET_ITEM(s_fast, i);
         if (i) {
             if (_PyAccu_Accumulate(acc, s->item_separator))
                 goto bail;