commit 2ee87913dde038436a25f1db13ee3fddd2bcc983
author Dong-hee Na <donghee.na92@gmail.com> Tue Dec 31 13:15:36 2019 +0900
committer Pablo Galindo <Pablogsal@gmail.com> Tue Dec 31 04:15:36 2019 +0000
tree 506d007f2e4b809e8360d086ba91b50568233980
parent a278ae19b4daa1deb11e2a8eed38838027e90ece

[3.8] bpo-38588: Fix possible crashes in dict and list when calling P… (GH-17764)

* [3.8] bpo-38588: Fix possible crashes in dict and list when calling PyObject_RichCompareBool (GH-17734)

Take strong references before calling PyObject_RichCompareBool to protect against the case
where the object dies during the call.
(cherry picked from commit 2d5bf568eaa5059402ccce9ba5a366986ba27c8a)

Co-authored-by: Dong-hee Na <donghee.na92@gmail.com>

* Update Objects/listobject.c

@methane's suggestion

Co-Authored-By: Inada Naoki <songofacandy@gmail.com>

Co-authored-by: Inada Naoki <songofacandy@gmail.com>

Objects/listobject.c

diff --git a/Objects/listobject.c b/Objects/listobject.c
index 8b52fa5..d506c08 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -2664,8 +2664,18 @@
 
     /* Search for the first index where items are different */
     for (i = 0; i < Py_SIZE(vl) && i < Py_SIZE(wl); i++) {
+        PyObject *vitem = vl->ob_item[i];
+        PyObject *witem = wl->ob_item[i];
+        if (vitem == witem) {
+            continue;
+        }
+
+        Py_INCREF(vitem);
+        Py_INCREF(witem);
         int k = PyObject_RichCompareBool(vl->ob_item[i],
                                          wl->ob_item[i], Py_EQ);
+        Py_DECREF(vitem);
+        Py_DECREF(witem);
         if (k < 0)
             return NULL;
         if (!k)