commit e727d41ffcd91b21ce82026ec8c8381d34a16209
author Victor Stinner <victor.stinner@gmail.com> Mon Sep 18 05:29:37 2017 -0700
committer GitHub <noreply@github.com> Mon Sep 18 05:29:37 2017 -0700
tree 6fe96261c5baf6fe58a218c6c1d3649d931c8606
parent 9b47af65375fab9318e88ccb061394a36c8c6c33

bpo-31499, xml.etree: Fix xmlparser_gc_clear() crash (#3641)

* bpo-31499, xml.etree: Fix xmlparser_gc_clear() crash

xml.etree: xmlparser_gc_clear() now sets self.parser to NULL to prevent a
crash in xmlparser_dealloc() if xmlparser_gc_clear() was called previously
by the garbage collector, because the parser was part of a reference cycle.

Co-Authored-By: Serhiy Storchaka <storchaka@gmail.com>

Modules/_elementtree.c

diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
index 28d0181..bddac85 100644
--- a/Modules/_elementtree.c
+++ b/Modules/_elementtree.c
@@ -3411,7 +3411,11 @@
 static int
 xmlparser_gc_clear(XMLParserObject *self)
 {
-    EXPAT(ParserFree)(self->parser);
+    if (self->parser != NULL) {
+        XML_Parser parser = self->parser;
+        self->parser = NULL;
+        EXPAT(ParserFree)(parser);
+    }
 
     Py_CLEAR(self->handle_close);
     Py_CLEAR(self->handle_pi);