From 6150f31963cbc24c529b07f6763854fbb7e62f60 Mon Sep 17 00:00:00 2001
From: Victor Stinner <victor.stinner@gmail.com>
Date: Wed, 16 Mar 2016 23:25:02 +0100
Subject: Fix usage of PyMem_Malloc() in overlapped.c

Issue #26563: Replace PyMem_Malloc() with PyMem_RawFree() since
PostToQueueCallback() calls PyMem_RawFree() (previously PyMem_Free()) in a new
C thread which doesn't hold the GIL.
---
 Modules/overlapped.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/Modules/overlapped.c b/Modules/overlapped.c
index ef77c88..8e6d397 100644
--- a/Modules/overlapped.c
+++ b/Modules/overlapped.c
@@ -238,7 +238,7 @@ PostToQueueCallback(PVOID lpParameter, BOOL TimerOrWaitFired)
     PostQueuedCompletionStatus(p->CompletionPort, TimerOrWaitFired,
                                0, p->Overlapped);
     /* ignore possible error! */
-    PyMem_Free(p);
+    PyMem_RawFree(p);
 }
 
 PyDoc_STRVAR(
@@ -262,7 +262,10 @@ overlapped_RegisterWaitWithQueue(PyObject *self, PyObject *args)
                           &Milliseconds))
         return NULL;
 
-    pdata = PyMem_Malloc(sizeof(struct PostCallbackData));
+    /* Use PyMem_RawMalloc() rather than PyMem_Malloc(), since
+       PostToQueueCallback() will call PyMem_Free() from a new C thread
+       which doesn't hold the GIL. */
+    pdata = PyMem_RawMalloc(sizeof(struct PostCallbackData));
     if (pdata == NULL)
         return SetFromWindowsErr(0);
 
@@ -273,7 +276,7 @@ overlapped_RegisterWaitWithQueue(PyObject *self, PyObject *args)
             pdata, Milliseconds,
             WT_EXECUTEINWAITTHREAD | WT_EXECUTEONLYONCE))
     {
-        PyMem_Free(pdata);
+        PyMem_RawFree(pdata);
         return SetFromWindowsErr(0);
     }
 
-- 
cgit v0.12

