mirror of
https://github.com/python/cpython.git
synced 2026-10-28 10:25:05 +08:00
Timur Mamedov
4ecf6ca1b3
_CALL_LIST_APPEND stole the arg stackref via PyStackRef_AsPyObjectSteal and passed it to _PyList_AppendTakeRef. When the list's backing array failed to grow, _PyList_AppendTakeRef decreffed the item, but the stale stackref remained on the value stack. The exception unwinder then closed it a second time, causing a double-free / use-after-free. Fix by giving _PyList_AppendTakeRef a separate reference via Py_NewRef and closing the stackref explicitly on success. On the error path the stackref still holds a valid reference, so the exception unwinder can safely close it.
The Python C API ================ The C API is divided into these sections: 1. ``Include/``: Limited API 2. ``Include/cpython/``: CPython implementation details 3. ``Include/cpython/``, names with the ``PyUnstable_`` prefix: API that can change between minor releases 4. ``Include/internal/``, and any name with ``_`` prefix: The internal API Information on changing the C API is available `in the developer guide`_ .. _in the developer guide: https://devguide.python.org/c-api/