fix(io): keep BufferedReader alive via readinto memoryview

Author: ashm-dev

Lib/test/test_io/test_bufferedio.py

@@ -607,6 +607,27 @@ def test_args_error(self):
         with self.assertRaisesRegex(TypeError, "BufferedReader"):
             self.tp(self.BytesIO(), 1024, 1024, 1024)
 
+    def test_readinto_buffer_keeps_reader_alive(self):
+        # gh-157364: raw.readinto() may store the memoryview it is given, so
+        # the memoryview must keep the BufferedReader owning its memory alive.
+        stored = []
+
+        class StoringRawIO(self.MockRawIO):
+            def readinto(self, b):
+                stored.append(b)
+                return super().readinto(b)
+
+        bufio = self.tp(StoringRawIO([b"abc"]))
+        self.assertEqual(bufio.read(3), b"abc")
+        self.assertIs(stored[0].obj, bufio)
+        wr = weakref.ref(bufio)
+        del bufio
+        support.gc_collect()
+        self.assertIsNotNone(wr())
+        stored.clear()
+        support.gc_collect()
+        self.assertIsNone(wr())
+
     def test_bad_readinto_value(self):
         rawio = self.tp(self.BytesIO(b"12"))
         rawio.readinto = lambda buf: -1

Misc/NEWS.d/next/Library/2026-09-12-18-03-15.gh-issue-157364.Qd7mKs.rst

@@ -1,2 +1,4 @@
 Fix a use-after-free in :class:`io.TextIOWrapper` when a call to the
-underlying buffer reentrantly detaches it. Patched by Shamil Abdulaev.
+underlying buffer reentrantly detaches it. The :class:`memoryview` that
+:class:`io.BufferedReader` passes to the raw stream's ``readinto()`` now keeps
+the reader alive. Patched by Shamil Abdulaev.

Modules/_io/bufferedio.c

@@ -10,6 +10,7 @@
 #include "Python.h"
 #include "pycore_call.h"                // _PyObject_CallNoArgs()
 #include "pycore_fileutils.h"           // _PyFile_Flush
+#include "pycore_memoryobject.h"        // _PyMemoryView_FromBufferProc()
 #include "pycore_object.h"              // _PyObject_GC_UNTRACK()
 #include "pycore_pyerrors.h"            // _Py_FatalErrorFormat()
 #include "pycore_pylifecycle.h"         // _Py_IsInterpreterFinalizing()
@@ -254,6 +255,10 @@ typedef struct {
        isn't ready for writing. */
     Py_off_t write_end;
 
+    /* Region handed to the raw stream by _bufferedreader_raw_read(). */
+    char *raw_read_start;
+    Py_ssize_t raw_read_len;
+
     PyThread_type_lock lock;
     volatile unsigned long owner;
 
@@ -1619,16 +1624,25 @@ _io_BufferedReader___init___impl(buffered *self, PyObject *raw,
     return 0;
 }
 
+/* The memoryview passed to raw.readinto() owns a reference to the buffered
+   object so that storing it in Python code cannot outlive its memory. */
+static int
+_bufferedreader_raw_read_getbuffer(PyObject *op, Py_buffer *view, int flags)
+{
+    buffered *self = buffered_CAST(op);
+    return PyBuffer_FillInfo(view, op, self->raw_read_start,
+                             self->raw_read_len, 0, flags);
+}
+
 static Py_ssize_t
 _bufferedreader_raw_read(buffered *self, char *start, Py_ssize_t len)
 {
-    Py_buffer buf;
     PyObject *memobj, *res;
     Py_ssize_t n;
-    /* NOTE: the buffer needn't be released as its object is NULL. */
-    if (PyBuffer_FillInfo(&buf, NULL, start, len, 0, PyBUF_CONTIG) == -1)
-        return -1;
-    memobj = PyMemoryView_FromBuffer(&buf);
+    self->raw_read_start = start;
+    self->raw_read_len = len;
+    memobj = _PyMemoryView_FromBufferProc((PyObject *)self, PyBUF_CONTIG,
+                                          _bufferedreader_raw_read_getbuffer);
     if (memobj == NULL)
         return -1;
     /* NOTE: PyErr_SetFromErrno() calls PyErr_CheckSignals() when EINTR