bpo-40412: Nullify inittab_copy during finalization (GH-19746)

miss-islington · indygreg · web-flow · commit 1205afb3e101 · 2020-05-01T16:06:23.000-07:00
Otherwise we leave a dangling pointer to free'd memory. If we then initialize a new interpreter in the same process and call PyImport_ExtendInittab, we will (likely) crash when calling PyMem_RawRealloc(inittab_copy, ...) since the pointer address is bogus. Automerge-Triggered-By: @brettcannon (cherry picked from commit 64224a4) Co-authored-by: Gregory Szorc <gregory.szorc@gmail.com>
diff --git a/Misc/NEWS.d/next/C API/2020-05-01-17-28-04.bpo-40412.dE0D8N.rst b/Misc/NEWS.d/next/C API/2020-05-01-17-28-04.bpo-40412.dE0D8N.rst
@@ -0,0 +1 @@
+Nullify inittab_copy during finalization, preventing future interpreter initializations in an embedded situation from crashing. Patch by Gregory Szorc.
diff --git a/Python/import.c b/Python/import.c
@@ -300,6 +300,7 @@ _PyImport_Fini2(void)
 
     /* Free memory allocated by PyImport_ExtendInittab() */
     PyMem_RawFree(inittab_copy);
+    inittab_copy = NULL;
 
     PyMem_SetAllocator(PYMEM_DOMAIN_RAW, &old_alloc);
 }

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+Nullify inittab_copy during finalization, preventing future interpreter initializations in an embedded situation from crashing. Patch by Gregory Szorc.`
Original file line number	Diff line number	Diff line change
`@@ -300,6 +300,7 @@ _PyImport_Fini2(void)`
`300`	`300`
`301`	`301`	`/* Free memory allocated by PyImport_ExtendInittab() */`
`302`	`302`	`PyMem_RawFree(inittab_copy);`
	`303`	`+ inittab_copy = NULL;`
`303`	`304`
`304`	`305`	`PyMem_SetAllocator(PYMEM_DOMAIN_RAW, &old_alloc);`
`305`	`306`	`}`