[3.12] gh-126405: fix use-after-free in _asyncio.Future.remove_done_callback (GH-126733) (#126737)

gh-126405: fix use-after-free in `_asyncio.Future.remove_done_callback` (GH-126733)
(cherry picked from commit 37c57dfad1)

Co-authored-by: Kumar Aditya <kumaraditya@python.org>
This commit is contained in:
Miss Islington (bot) 2024-11-12 14:04:25 +01:00 committed by GitHub
parent 86efa2f1fa
commit b13b84ab70
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -1073,8 +1073,10 @@ _asyncio_Future_remove_done_callback_impl(FutureObj *self, PyTypeObject *cls,
if (len == 1) {
PyObject *cb_tup = PyList_GET_ITEM(self->fut_callbacks, 0);
Py_INCREF(cb_tup);
int cmp = PyObject_RichCompareBool(
PyTuple_GET_ITEM(cb_tup, 0), fn, Py_EQ);
Py_DECREF(cb_tup);
if (cmp == -1) {
return NULL;
}