Skip to content

Commit 5d4d511

Browse files
fix: pickle whichmodule has a UAF on free-threading
1 parent 6372d48 commit 5d4d511

1 file changed

Lines changed: 16 additions & 4 deletions

File tree

Modules/_pickle.c

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2055,22 +2055,34 @@ whichmodule(PickleState *st, PyObject *global, PyObject *global_name, PyObject *
20552055
return NULL;
20562056
}
20572057
if (PyDict_CheckExact(modules)) {
2058+
PyObject *found_name = NULL;
2059+
int error = 0;
20582060
i = 0;
2061+
Py_BEGIN_CRITICAL_SECTION(modules);
20592062
while (PyDict_Next(modules, &i, &module_name, &module)) {
20602063
Py_INCREF(module_name);
20612064
Py_INCREF(module);
20622065
if (_checkmodule(module_name, module, global, dotted_path) == 0) {
20632066
Py_DECREF(module);
2064-
Py_DECREF(modules);
2065-
return module_name;
2067+
found_name = module_name;
2068+
break;
20662069
}
20672070
Py_DECREF(module);
20682071
Py_DECREF(module_name);
20692072
if (PyErr_Occurred()) {
2070-
Py_DECREF(modules);
2071-
return NULL;
2073+
error = 1;
2074+
break;
20722075
}
20732076
}
2077+
Py_END_CRITICAL_SECTION();
2078+
if (found_name != NULL) {
2079+
Py_DECREF(modules);
2080+
return found_name;
2081+
}
2082+
if (error) {
2083+
Py_DECREF(modules);
2084+
return NULL;
2085+
}
20742086
}
20752087
else {
20762088
PyObject *iterator = PyObject_GetIter(modules);

0 commit comments

Comments
 (0)