Skip to content

gh-155493: Fix crash in decimal SignalDict on re-entrant Context teardown - #155494

Open
tonghuaroot wants to merge 1 commit into
python:mainfrom
tonghuaroot:file-decimal-signaldict-uaf
Open

gh-155493: Fix crash in decimal SignalDict on re-entrant Context teardown#155494
tonghuaroot wants to merge 1 commit into
python:mainfrom
tonghuaroot:file-decimal-signaldict-uaf

Conversation

@tonghuaroot

@tonghuaroot tonghuaroot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

signaldict_setitem and signaldict_richcompare read the borrowed flags
pointer after PyObject_IsTrue calls the value's __bool__, which can
deallocate the owning Context. gh-146011 added this guard to
signaldict_repr; this extends it to the two remaining methods that borrow
the pointer across a Python call.

…t teardown

signaldict_setitem and signaldict_richcompare read the borrowed flags
pointer after PyObject_IsTrue calls the value's __bool__, which can
deallocate the owning Context. pythongh-146011 added this guard to
signaldict_repr; this extends it to the two remaining methods.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant