bpo-40412: Nullify inittab_copy during finalization (GH-19746)

indygreg · web-flow · commit 64224a472732 · 2020-05-01T11:07:54.000-07:00
Otherwise we leave a dangling pointer to free'd memory. If we then initialize a new interpreter in the same process and call PyImport_ExtendInittab, we will (likely) crash when calling PyMem_RawRealloc(inittab_copy, ...) since the pointer address is bogus. Automerge-Triggered-By: @brettcannon
diff --git a/Misc/NEWS.d/next/C API/2020-05-01-17-28-04.bpo-40412.dE0D8N.rst b/Misc/NEWS.d/next/C API/2020-05-01-17-28-04.bpo-40412.dE0D8N.rst
@@ -0,0 +1 @@
+Nullify inittab_copy during finalization, preventing future interpreter initializations in an embedded situation from crashing. Patch by Gregory Szorc.
diff --git a/Python/import.c b/Python/import.c
@@ -298,6 +298,7 @@ _PyImport_Fini2(void)
 
     /* Free memory allocated by PyImport_ExtendInittab() */
     PyMem_RawFree(inittab_copy);
+    inittab_copy = NULL;
 
     PyMem_SetAllocator(PYMEM_DOMAIN_RAW, &old_alloc);
 }

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+Nullify inittab_copy during finalization, preventing future interpreter initializations in an embedded situation from crashing. Patch by Gregory Szorc.`
Original file line number	Diff line number	Diff line change
`@@ -298,6 +298,7 @@ _PyImport_Fini2(void)`
`298`	`298`
`299`	`299`	`/* Free memory allocated by PyImport_ExtendInittab() */`
`300`	`300`	`PyMem_RawFree(inittab_copy);`
	`301`	`+ inittab_copy = NULL;`
`301`	`302`
`302`	`303`	`PyMem_SetAllocator(PYMEM_DOMAIN_RAW, &old_alloc);`
`303`	`304`	`}`