Skip to content

gh-157364: Fix use-after-free in TextIOWrapper during reentrant detach #157370

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vstinner merged 7 commits into from
Oct 7, 2026
Merged

gh-157364: Fix use-after-free in TextIOWrapper during reentrant detach #157370

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
979a884
fix(io): keep TextIOWrapper buffer alive during calls
ashm-dev Sep 12, 2026
05510fb
Merge branch 'main' into gh-157364
ashm-dev Sep 12, 2026
c3755e4
refactor(io): return strong ref from buffer_access_safe
ashm-dev Sep 13, 2026
9763043
fix(io): keep BufferedReader alive via readinto memoryview
ashm-dev Sep 22, 2026
7e1eedd
fix(io): scope UAF patch to TextIOWrapper
ashm-dev Oct 6, 2026
aa9a179
refactor(io): preserve detach state update order
ashm-dev Oct 7, 2026
e654017
Apply suggestion from @vstinner
vstinner Oct 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
refactor(io): preserve detach state update order
  • Loading branch information
@ashm-dev
ashm-dev committed Oct 7, 2026
commit aa9a1794ec25fbbb7e0bb7283fa595d2448f4710
2 changes: 1 addition & 1 deletion Modules/_io/textio.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1643,8 +1643,8 @@ _io_TextIOWrapper_detach_impl(textio *self)
if (buffer == NULL) {
return NULL;
}
self->detached = 1;
Py_CLEAR(self->buffer);
Comment thread
ashm-dev marked this conversation as resolved.
self->detached = 1;
return buffer;
}

Expand Down
Loading