cpython icon indicating copy to clipboard operation
cpython copied to clipboard

gh-142663: Fix use-after-free in memoryview comparison

Open superboy-zjc opened this issue 2 weeks ago • 1 comments

When comparing two memoryview objects with different formats, memory_richcompare uses the struct module to unpack elements. A custom struct.Struct.unpack_from implementation could releases and resizes underlying buffer, which invalidates the buffer pointer, during iteration. This leads to a use-after-free when the comparison loop continued accessing the freed memory.

The fix increments the exports count of the memoryview objects before performing the comparison, effectively locking the buffers. This mirrors the protection already provided for non-memoryview objects via PyObject_GetBuffer.

  • Issue: gh-142663

superboy-zjc avatar Dec 31 '25 06:12 superboy-zjc