[3.13] gh-120298: Fix use-after-free in list_richcompare_impl (GH-120303) (#120340)

miss-islington · sobolevn · serhiy-storchaka · web-flow · commit 52225c64f7cd · 2024-06-11T07:28:45.000Z
gh-120298: Fix use-after-free in `list_richcompare_impl` (GH-120303) (cherry picked from commit 141baba) Co-authored-by: Nikita Sobolev <mail@sobolevn.me> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
diff --git a/Lib/test/test_list.py b/Lib/test/test_list.py
@@ -234,6 +234,17 @@ def __eq__(self, other):
         list4 = [1]
         self.assertFalse(list3 == list4)
 
+    def test_lt_operator_modifying_operand(self):
+        # See gh-120298
+        class evil:
+            def __lt__(self, other):
+                other.clear()
+                return NotImplemented
+
+        a = [[evil()]]
+        with self.assertRaises(TypeError):
+            a[0] < a
+
     @cpython_only
     def test_preallocation(self):
         iterable = [0] * 10
diff --git a/Misc/NEWS.d/next/Core and Builtins/2024-06-10-10-42-48.gh-issue-120298.napREA.rst b/Misc/NEWS.d/next/Core and Builtins/2024-06-10-10-42-48.gh-issue-120298.napREA.rst
@@ -0,0 +1,2 @@
+Fix use-after free in ``list_richcompare_impl`` which can be invoked via
+some specificly tailored evil input.
diff --git a/Objects/listobject.c b/Objects/listobject.c
@@ -3382,7 +3382,14 @@ list_richcompare_impl(PyObject *v, PyObject *w, int op)
     }
 
     /* Compare the final item again using the proper operator */
-    return PyObject_RichCompare(vl->ob_item[i], wl->ob_item[i], op);
+    PyObject *vitem = vl->ob_item[i];
+    PyObject *witem = wl->ob_item[i];
+    Py_INCREF(vitem);
+    Py_INCREF(witem);
+    PyObject *result = PyObject_RichCompare(vl->ob_item[i], wl->ob_item[i], op);
+    Py_DECREF(vitem);
+    Py_DECREF(witem);
+    return result;
 }
 
 static PyObject *

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	+Fix use-after free in ``list_richcompare_impl`` which can be invoked via
	`2`	`+some specificly tailored evil input.`
Original file line number	Diff line number	Diff line change
`@@ -3382,7 +3382,14 @@ list_richcompare_impl(PyObject v, PyObject w, int op)`
`3382`	`3382`	`}`
`3383`	`3383`
`3384`	`3384`	`/* Compare the final item again using the proper operator */`
`3385`		`- return PyObject_RichCompare(vl->ob_item[i], wl->ob_item[i], op);`
	`3385`	`+ PyObject *vitem = vl->ob_item[i];`
	`3386`	`+ PyObject *witem = wl->ob_item[i];`
	`3387`	`+ Py_INCREF(vitem);`
	`3388`	`+ Py_INCREF(witem);`
	`3389`	`+ PyObject *result = PyObject_RichCompare(vl->ob_item[i], wl->ob_item[i], op);`
	`3390`	`+ Py_DECREF(vitem);`
	`3391`	`+ Py_DECREF(witem);`
	`3392`	`+ return result;`
`3386`	`3393`	`}`
`3387`	`3394`
`3388`	`3395`	`static PyObject *`