gh-148735: Fix a UAF in Element.findtext() (#148738)

StanFromIreland · web-flow · commit 0469e6d38dcb · 2026-04-23T15:48:00.000+01:00
diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py
@@ -3271,6 +3271,16 @@ def test_findtext_with_mutating(self):
                 e.extend([ET.Element('bar')])
                 e.findtext(cls(e, 'x'))
 
+    def test_findtext_with_mutating_non_none_text(self):
+        for cls in [MutationDeleteElementPath, MutationClearElementPath]:
+            with self.subTest(cls):
+                e = ET.Element('foo')
+                child = ET.Element('bar')
+                child.text = str(object())
+                e.append(child)
+                del child
+                repr(e.findtext(cls(e, 'x')))
+
     def test_findtext_with_error(self):
         e = ET.Element('foo')
         e.extend([ET.Element('bar')])
diff --git a/Misc/NEWS.d/next/Library/2026-04-18-21-39-15.gh-issue-148735.siw6DG.rst b/Misc/NEWS.d/next/Library/2026-04-18-21-39-15.gh-issue-148735.siw6DG.rst
@@ -0,0 +1,3 @@
+:mod:`xml.etree.ElementTree`: Fix a use-after-free in
+:meth:`Element.findtext <xml.etree.ElementTree.Element.findtext>` when the
+element tree is mutated concurrently during the search.
diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
@@ -573,7 +573,7 @@ element_get_attrib(ElementObject* self)
 LOCAL(PyObject*)
 element_get_text(ElementObject* self)
 {
-    /* return borrowed reference to text attribute */
+    /* return new reference to text attribute */
 
     PyObject *res = self->text;
 
@@ -588,13 +588,13 @@ element_get_text(ElementObject* self)
         }
     }
 
-    return res;
+    return Py_NewRef(res);
 }
 
 LOCAL(PyObject*)
 element_get_tail(ElementObject* self)
 {
-    /* return borrowed reference to text attribute */
+    /* return new reference to tail attribute */
 
     PyObject *res = self->tail;
 
@@ -609,7 +609,7 @@ element_get_tail(ElementObject* self)
         }
     }
 
-    return res;
+    return Py_NewRef(res);
 }
 
 static PyObject*
@@ -1359,9 +1359,9 @@ _elementtree_Element_findtext_impl(ElementObject *self, PyTypeObject *cls,
             PyObject *text = element_get_text((ElementObject *)item);
             Py_DECREF(item);
             if (text == Py_None) {
+                Py_DECREF(text);
                 return Py_GetConstant(Py_CONSTANT_EMPTY_STR);
             }
-            Py_XINCREF(text);
             return text;
         }
         Py_DECREF(item);
@@ -2064,16 +2064,14 @@ static PyObject*
 element_text_getter(PyObject *op, void *closure)
 {
     ElementObject *self = _Element_CAST(op);
-    PyObject *res = element_get_text(self);
-    return Py_XNewRef(res);
+    return element_get_text(self);
 }
 
 static PyObject*
 element_tail_getter(PyObject *op, void *closure)
 {
     ElementObject *self = _Element_CAST(op);
-    PyObject *res = element_get_tail(self);
-    return Py_XNewRef(res);
+    return element_get_tail(self);
 }
 
 static PyObject*
@@ -2316,16 +2314,14 @@ elementiter_next(PyObject *op)
         continue;
 
 gettext:
+        Py_DECREF(elem);
         if (!text) {
-            Py_DECREF(elem);
             return NULL;
         }
         if (text == Py_None) {
-            Py_DECREF(elem);
+            Py_DECREF(text);
         }
         else {
-            Py_INCREF(text);
-            Py_DECREF(elem);
             rc = PyObject_IsTrue(text);
             if (rc > 0)
                 return text;

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	+:mod:`xml.etree.ElementTree`: Fix a use-after-free in
	`2`	+:meth:`Element.findtext <xml.etree.ElementTree.Element.findtext>` when the
	`3`	`+element tree is mutated concurrently during the search.`
Original file line number	Diff line number	Diff line change
`@@ -573,7 +573,7 @@ element_get_attrib(ElementObject* self)`
`573`	`573`	`LOCAL(PyObject*)`
`574`	`574`	`element_get_text(ElementObject* self)`
`575`	`575`	`{`
`576`		`- /* return borrowed reference to text attribute */`
	`576`	`+ /* return new reference to text attribute */`
`577`	`577`
`578`	`578`	`PyObject *res = self->text;`
`579`	`579`
`@@ -588,13 +588,13 @@ element_get_text(ElementObject* self)`
`588`	`588`	`}`
`589`	`589`	`}`
`590`	`590`
`591`		`- return res;`
	`591`	`+ return Py_NewRef(res);`
`592`	`592`	`}`
`593`	`593`
`594`	`594`	`LOCAL(PyObject*)`
`595`	`595`	`element_get_tail(ElementObject* self)`
`596`	`596`	`{`
`597`		`- /* return borrowed reference to text attribute */`
	`597`	`+ /* return new reference to tail attribute */`
`598`	`598`
`599`	`599`	`PyObject *res = self->tail;`
`600`	`600`
`@@ -609,7 +609,7 @@ element_get_tail(ElementObject* self)`
`609`	`609`	`}`
`610`	`610`	`}`
`611`	`611`
`612`		`- return res;`
	`612`	`+ return Py_NewRef(res);`
`613`	`613`	`}`
`614`	`614`
`615`	`615`	`static PyObject*`
`@@ -1359,9 +1359,9 @@ _elementtree_Element_findtext_impl(ElementObject self, PyTypeObject cls,`
`1359`	`1359`	`PyObject text = element_get_text((ElementObject )item);`
`1360`	`1360`	`Py_DECREF(item);`
`1361`	`1361`	`if (text == Py_None) {`
	`1362`	`+ Py_DECREF(text);`
`1362`	`1363`	`return Py_GetConstant(Py_CONSTANT_EMPTY_STR);`
`1363`	`1364`	`}`
`1364`		`- Py_XINCREF(text);`
`1365`	`1365`	`return text;`
`1366`	`1366`	`}`
`1367`	`1367`	`Py_DECREF(item);`
`@@ -2064,16 +2064,14 @@ static PyObject*`
`2064`	`2064`	`element_text_getter(PyObject op, void closure)`
`2065`	`2065`	`{`
`2066`	`2066`	`ElementObject *self = _Element_CAST(op);`
`2067`		`- PyObject *res = element_get_text(self);`
`2068`		`- return Py_XNewRef(res);`
	`2067`	`+ return element_get_text(self);`
`2069`	`2068`	`}`
`2070`	`2069`
`2071`	`2070`	`static PyObject*`
`2072`	`2071`	`element_tail_getter(PyObject op, void closure)`
`2073`	`2072`	`{`
`2074`	`2073`	`ElementObject *self = _Element_CAST(op);`
`2075`		`- PyObject *res = element_get_tail(self);`
`2076`		`- return Py_XNewRef(res);`
	`2074`	`+ return element_get_tail(self);`
`2077`	`2075`	`}`
`2078`	`2076`
`2079`	`2077`	`static PyObject*`
`@@ -2316,16 +2314,14 @@ elementiter_next(PyObject *op)`
`2316`	`2314`	`continue;`
`2317`	`2315`
`2318`	`2316`	`gettext:`
	`2317`	`+ Py_DECREF(elem);`
`2319`	`2318`	`if (!text) {`
`2320`		`- Py_DECREF(elem);`
`2321`	`2319`	`return NULL;`
`2322`	`2320`	`}`
`2323`	`2321`	`if (text == Py_None) {`
`2324`		`- Py_DECREF(elem);`
	`2322`	`+ Py_DECREF(text);`
`2325`	`2323`	`}`
`2326`	`2324`	`else {`
`2327`		`- Py_INCREF(text);`
`2328`		`- Py_DECREF(elem);`
`2329`	`2325`	`rc = PyObject_IsTrue(text);`
`2330`	`2326`	`if (rc > 0)`
`2331`	`2327`	`return text;`