diff options
| author | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2024-06-11 07:28:45 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-06-11 07:28:45 (GMT) |
| commit | 52225c64f7cd55f2bfe8515d4daf1a5ed4be6d7b (patch) | |
| tree | a2ac89998c6c0baccb97dd71faa0442906fd77cb /Objects | |
| parent | 81eae217335fc66bec343b9f11f1b68fe85667bf (diff) | |
| download | cpython-52225c64f7cd55f2bfe8515d4daf1a5ed4be6d7b.zip cpython-52225c64f7cd55f2bfe8515d4daf1a5ed4be6d7b.tar.gz cpython-52225c64f7cd55f2bfe8515d4daf1a5ed4be6d7b.tar.bz2 | |
[3.13] gh-120298: Fix use-after-free in `list_richcompare_impl` (GH-120303) (#120340)
gh-120298: Fix use-after-free in `list_richcompare_impl` (GH-120303)
(cherry picked from commit 141babad9b4eceb83371bf19ba3a36b50dd05250)
Co-authored-by: Nikita Sobolev <mail@sobolevn.me>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Diffstat (limited to 'Objects')
| -rw-r--r-- | Objects/listobject.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/Objects/listobject.c b/Objects/listobject.c index d09bb63..6829d5d 100644 --- a/Objects/listobject.c +++ b/Objects/listobject.c @@ -3382,7 +3382,14 @@ list_richcompare_impl(PyObject *v, PyObject *w, int op) } /* Compare the final item again using the proper operator */ - return PyObject_RichCompare(vl->ob_item[i], wl->ob_item[i], op); + PyObject *vitem = vl->ob_item[i]; + PyObject *witem = wl->ob_item[i]; + Py_INCREF(vitem); + Py_INCREF(witem); + PyObject *result = PyObject_RichCompare(vl->ob_item[i], wl->ob_item[i], op); + Py_DECREF(vitem); + Py_DECREF(witem); + return result; } static PyObject * |