From 074e7659f208051b6b973f7fdb654dd22b93aaa2 Mon Sep 17 00:00:00 2001 From: "T. Wouters" Date: Fri, 16 Jul 2021 00:40:57 +0200 Subject: bpo-44184: Apply GH-26274 to the non-GC-type branch of subtype_dealloc (GH-27165) The non-GC-type branch of subtype_dealloc is using the type of an object after freeing in the same unsafe way as GH-26274 fixes. (I believe the old news entry covers this change well enough.) https://bugs.python.org/issue44184 --- Objects/typeobject.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/Objects/typeobject.c b/Objects/typeobject.c index 02ea618..3331fee 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -1368,14 +1368,22 @@ subtype_dealloc(PyObject *self) /* Extract the type again; tp_del may have changed it */ type = Py_TYPE(self); + // Don't read type memory after calling basedealloc() since basedealloc() + // can deallocate the type and free its memory. + int type_needs_decref = (type->tp_flags & Py_TPFLAGS_HEAPTYPE + && !(base->tp_flags & Py_TPFLAGS_HEAPTYPE)); + /* Call the base tp_dealloc() */ assert(basedealloc); basedealloc(self); - /* Only decref if the base type is not already a heap allocated type. - Otherwise, basedealloc should have decref'd it already */ - if (type->tp_flags & Py_TPFLAGS_HEAPTYPE && !(base->tp_flags & Py_TPFLAGS_HEAPTYPE)) + /* Can't reference self beyond this point. It's possible tp_del switched + our type from a HEAPTYPE to a non-HEAPTYPE, so be careful about + reference counting. Only decref if the base type is not already a heap + allocated type. Otherwise, basedealloc should have decref'd it already */ + if (type_needs_decref) { Py_DECREF(type); + } /* Done */ return; -- cgit v0.12