diff options
| author | Nikita Sobolev <mail@sobolevn.me> | 2024-06-11 07:04:27 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-06-11 07:04:27 (GMT) |
| commit | 141babad9b4eceb83371bf19ba3a36b50dd05250 (patch) | |
| tree | e702831575588b5c82135b0e8754a40aaad515bb /Objects | |
| parent | 9e9ee50421c857b443e2060274f17fb884d54473 (diff) | |
| download | cpython-141babad9b4eceb83371bf19ba3a36b50dd05250.zip cpython-141babad9b4eceb83371bf19ba3a36b50dd05250.tar.gz cpython-141babad9b4eceb83371bf19ba3a36b50dd05250.tar.bz2 | |
gh-120298: Fix use-after-free in `list_richcompare_impl` (#120303)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Diffstat (limited to 'Objects')
| -rw-r--r-- | Objects/listobject.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/Objects/listobject.c b/Objects/listobject.c index d09bb63..6829d5d 100644 --- a/Objects/listobject.c +++ b/Objects/listobject.c @@ -3382,7 +3382,14 @@ list_richcompare_impl(PyObject *v, PyObject *w, int op) } /* Compare the final item again using the proper operator */ - return PyObject_RichCompare(vl->ob_item[i], wl->ob_item[i], op); + PyObject *vitem = vl->ob_item[i]; + PyObject *witem = wl->ob_item[i]; + Py_INCREF(vitem); + Py_INCREF(witem); + PyObject *result = PyObject_RichCompare(vl->ob_item[i], wl->ob_item[i], op); + Py_DECREF(vitem); + Py_DECREF(witem); + return result; } static PyObject * |