commit fcaf14cd9179bb48850f8f81ce8d5cee28129745
author Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> Mon Dec 30 11:51:06 2019 -0800
committer GitHub <noreply@github.com> Mon Dec 30 11:51:06 2019 -0800
tree e8281cbb027c504902c686e84d818fd9a1f6047a
parent cbfafa3e3625dae96ce392c88c793f8af55167bf

bpo-38610: Fix possible crashes in several list methods (GH-17022)


Hold strong references to list elements while calling PyObject_RichCompareBool().
(cherry picked from commit d9e561d23d994e3ed15f4fcbd7ee5c8fe50f190b)

Co-authored-by: Zackery Spytz <zspytz@gmail.com>

Objects/listobject.c

diff --git a/Objects/listobject.c b/Objects/listobject.c
index f8bf45e..8b52fa5 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -2555,7 +2555,10 @@
             stop = 0;
     }
     for (i = start; i < stop && i < Py_SIZE(self); i++) {
-        int cmp = PyObject_RichCompareBool(self->ob_item[i], value, Py_EQ);
+        PyObject *obj = self->ob_item[i];
+        Py_INCREF(obj);
+        int cmp = PyObject_RichCompareBool(obj, value, Py_EQ);
+        Py_DECREF(obj);
         if (cmp > 0)
             return PyLong_FromSsize_t(i);
         else if (cmp < 0)
@@ -2582,7 +2585,10 @@
     Py_ssize_t i;
 
     for (i = 0; i < Py_SIZE(self); i++) {
-        int cmp = PyObject_RichCompareBool(self->ob_item[i], value, Py_EQ);
+        PyObject *obj = self->ob_item[i];
+        Py_INCREF(obj);
+        int cmp = PyObject_RichCompareBool(obj, value, Py_EQ);
+        Py_DECREF(obj);
         if (cmp > 0)
             count++;
         else if (cmp < 0)
@@ -2609,7 +2615,10 @@
     Py_ssize_t i;
 
     for (i = 0; i < Py_SIZE(self); i++) {
-        int cmp = PyObject_RichCompareBool(self->ob_item[i], value, Py_EQ);
+        PyObject *obj = self->ob_item[i];
+        Py_INCREF(obj);
+        int cmp = PyObject_RichCompareBool(obj, value, Py_EQ);
+        Py_DECREF(obj);
         if (cmp > 0) {
             if (list_ass_slice(self, i, i+1,
                                (PyObject *)NULL) == 0)