[3.11] gh-99886: Fix crash when freeing objects with managed dictionaries (#99902)

Fidget-Spinner · erlend-aasland · web-flow · commit 9e38553132bf · 2022-12-04T14:41:23.000+08:00
Co-authored-by: Erlend E. Aasland &lt;erlend.aasland@protonmail.com&gt;
diff --git a/Lib/test/test_sqlite3/test_regression.py b/Lib/test/test_sqlite3/test_regression.py
@@ -469,6 +469,18 @@ def test_executescript_step_through_select(self):
             con.executescript("select step(t) from t")
             self.assertEqual(steps, values)
 
+    def test_custom_cursor_object_crash_gh_99886(self):
+        # This test segfaults on GH-99886
+        class MyCursor(sqlite.Cursor):
+            def __init__(self, *args, **kwargs):
+                super().__init__(*args, **kwargs)
+                # this can go before or after the super call; doesn't matter
+                self.some_attr = None
+
+        with memory_database() as con:
+            cur = con.cursor(MyCursor)
+            cur.close()
+            del cur
 
 class RecursiveUseOfCursors(unittest.TestCase):
     # GH-80254: sqlite3 should not segfault for recursive use of cursors.
diff --git a/Misc/NEWS.d/next/Core and Builtins/2022-11-30-15-29-08.gh-issue-99886.feJkSv.rst b/Misc/NEWS.d/next/Core and Builtins/2022-11-30-15-29-08.gh-issue-99886.feJkSv.rst
@@ -0,0 +1 @@
+Fix a crash when an object which does not have a dictionary frees its instance values.
diff --git a/Objects/dictobject.c b/Objects/dictobject.c
@@ -5573,14 +5573,16 @@ _PyObject_FreeInstanceAttributes(PyObject *self)
     PyTypeObject *tp = Py_TYPE(self);
     assert(Py_TYPE(self)->tp_flags & Py_TPFLAGS_MANAGED_DICT);
     PyDictValues **values_ptr = _PyObject_ValuesPointer(self);
-    if (*values_ptr == NULL) {
+    PyDictValues *values = *values_ptr;
+    if (values == NULL) {
         return;
     }
+    *values_ptr = NULL;
     PyDictKeysObject *keys = CACHED_KEYS(tp);
     for (Py_ssize_t i = 0; i < keys->dk_nentries; i++) {
-        Py_XDECREF((*values_ptr)->values[i]);
+        Py_XDECREF(values->values[i]);
     }
-    free_values(*values_ptr);
+    free_values(values);
 }
 
 PyObject *

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+Fix a crash when an object which does not have a dictionary frees its instance values.`
Original file line number	Diff line number	Diff line change
`@@ -5573,14 +5573,16 @@ _PyObject_FreeInstanceAttributes(PyObject *self)`
`5573`	`5573`	`PyTypeObject *tp = Py_TYPE(self);`
`5574`	`5574`	`assert(Py_TYPE(self)->tp_flags & Py_TPFLAGS_MANAGED_DICT);`
`5575`	`5575`	`PyDictValues **values_ptr = _PyObject_ValuesPointer(self);`
`5576`		`- if (*values_ptr == NULL) {`
	`5576`	`+ PyDictValues values = values_ptr;`
	`5577`	`+ if (values == NULL) {`
`5577`	`5578`	`return;`
`5578`	`5579`	`}`
	`5580`	`+ *values_ptr = NULL;`
`5579`	`5581`	`PyDictKeysObject *keys = CACHED_KEYS(tp);`
`5580`	`5582`	`for (Py_ssize_t i = 0; i < keys->dk_nentries; i++) {`
`5581`		`- Py_XDECREF((*values_ptr)->values[i]);`
	`5583`	`+ Py_XDECREF(values->values[i]);`
`5582`	`5584`	`}`
`5583`		`- free_values(*values_ptr);`
	`5585`	`+ free_values(values);`
`5584`	`5586`	`}`
`5585`	`5587`
`5586`	`5588`	`PyObject *`