Description

tonghuaroot

opened on Jul 11, 2026

Issue body actions

Bug report

Bug description:

The C implementation of bytearray.take_bytes() reads the size before calling
the argument's __index__(), then uses that stale size for the bounds check and
the buffer reads, so an __index__ that resizes the bytearray reads freed
memory (a use-after-free; segfaults on a debug build).

b = bytearray(b'A' * (16 * 1024 * 1024))
class Evil:
    def __index__(self):
        b.clear()
        return 8 * 1024 * 1024
b.take_bytes(Evil())   # use-after-free

bytearray.__setitem__ re-reads the size after __index__ (GH-91153).

CPython versions tested on:

3.15, 3.16

Operating systems tested on:

macOS

Linked PRs

• gh-153570: Fix use-after-free in bytearray.take_bytes() with a reentrant __index__ #153572
• [3.15] gh-153570: Fix use-after-free in bytearray.take_bytes() with a reentrant __index__ (GH-153572) #154648

Activity

1. tonghuaroot

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Jul 11, 2026
2. picnixz

   added

   interpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)

   on Jul 12, 2026
3. vstinner

   added a commit that references this issue on Jul 24, 2026

   gh-153570: Fix use-after-free in bytearray.take_bytes() with a reentr…

   ee21d99
4. cmaloney

   added

   3.15bugs and security fixesbugs and security fixes

   3.16new features, bugs and security fixesnew features, bugs and security fixes

   on Jul 24, 2026
5. vstinner

   added a commit that references this issue on Jul 24, 2026

   [3.15] gh-153570: Fix use-after-free in bytearray.take_bytes() with a…

   848f0ba
6. vstinner

   closed this as completedon Jul 24, 2026
7. mbeijen

   added a commit that references this issue on Aug 14, 2026

   pythongh-153570: Fix use-after-free in bytearray.take_bytes() with a …

   946e49f

Issue actions