Skip to content

gh-145678: Fix use-after-free in itertools.groupby _grouper_next() #145679

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
sampsonc wants to merge 12 commits into from
Closed

gh-145678: Fix use-after-free in itertools.groupby _grouper_next() #145679

Changes from 1 commit
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
79bcea0
gh-145678: Fix use-after-free in itertools.groupby _grouper_next()
sampsonc Mar 9, 2026
29df8e8
gh-145678: Simplify test_grouper_next_reentrant_eq_does_not_crash
sampsonc Mar 12, 2026
867c8ee
gh-145678: Remove unnecessary try/except in test
sampsonc Mar 12, 2026
cb4cc82
Update Modules/itertoolsmodule.c
sampsonc Mar 12, 2026
fbf0a25
Update Lib/test/test_itertools.py
sampsonc Mar 12, 2026
39dd69c
Update Misc/NEWS.d/next/Library/2026-03-09-00-00-00.gh-issue-145678.g…
sampsonc Mar 12, 2026
1fa0e35
Merge branch 'main' into gh-145678-grouper-uaf
sampsonc Mar 12, 2026
1863876
gh-145678: Update NEWS entry wording per review
sampsonc Mar 12, 2026
5daf7c4
Merge branch 'main' into gh-145678-grouper-uaf
sampsonc Mar 12, 2026
750b54a
gh-145678: Strengthen test to assert refcount invariant
sampsonc Mar 14, 2026
d9f4834
gh-145678: Guard against re-entrant __eq__ never being called
sampsonc Mar 14, 2026
fb85cf1
gh-145678: Revert sys.getrefcount assertions from test
sampsonc Mar 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Update Misc/NEWS.d/next/Library/2026-03-09-00-00-00.gh-issue-145678.g… 
…rouper-uaf.rst

Co-authored-by: Petr Viktorin <encukou@gmail.com>
  • Loading branch information
@sampsonc @encukou
sampsonc and encukou authored Mar 12, 2026
commit 39dd69c3ff2bc69c9b201d31e34efdd23472730d
8 changes: 2 additions & 6 deletions Misc/NEWS.d/next/Library/2026-03-09-00-00-00.gh-issue-145678.grouper-uaf.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,3 @@
Fix a use-after-free in :func:`itertools.groupby`: the internal
``_grouper_next()`` function did not hold strong references to
``gbo->currkey`` and ``igo->tgtkey`` before calling
:c:func:`PyObject_RichCompareBool`, so a re-entrant ``__eq__`` that advanced
the parent iterator (triggering ``groupby_step()`` and ``Py_XSETREF`` on
``currkey``) could free those objects while they were still being compared.
Fix a use-after-free crash in :func:`itertools.groupby` when a user-defined
``__eq__`` advanced the parent iterator while the iterator of groups was advanced.
Comment thread
sampsonc marked this conversation as resolved.
Outdated
The fix mirrors the protection added in :gh:`143543` for ``groupby_next()``.
Comment thread
sampsonc marked this conversation as resolved.
Outdated
Loading