Skip to content

Crash in garbage collection of the io.BytesIO buffer object #111211

Description

@serhiy-storchaka

Crash report

What happened?

If the buffer created by io.BytesIO.getbuffer() is a part of a reference loop, the garbage collector can crash. Reproducer:

import gc, io
memio = io.BytesIO(b"1234567890")
buf = memio.getbuffer()
a = [buf]
a.append(a)
del memio, buf
del a
gc.collect()

It is because bytesiobuf_clear() clears self->source, but bytesiobuf_releasebuffer() uses it.

bytesiobuf_clear() was added in #101819.

CPython versions tested on:

3.12, CPython main branch

Operating systems tested on:

No response

Output from running 'python -VV' on the command line:

No response

Activity

  1. added
    type-crashA hard crash of the interpreter, possibly with a core dump
    3.12only security fixes
    3.13only security fixes
    on Oct 23, 2023
  2. chgnrdv commented on Oct 23, 2023

    @chgnrdv
    Contributor

    See also #111049

  3. serhiy-storchaka commented on Oct 23, 2023

    @serhiy-storchaka
    MemberAuthor

    Indeed, it is the same bug.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.12only security fixes3.13only security fixestype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions