GeezerVison

Summary

Fix a heap-buffer-overflow (use-after-free) in functools.partial.__repr__() where a user-defined __repr__() on an argument could mutate the partial object via __setstate__(), freeing the args tuple while partial_repr() was still iterating over it.

Root Cause

partial_repr() captured the size of pto->args before the loop and accessed tuple items via borrowed references (PyTuple_GET_ITEM). If a __repr__() called during %R formatting invoked pto.__setstate__() with a new (smaller) args tuple, the original tuple was freed while iteration continued, causing an out-of-bounds read.

Fix

Hold strong references (Py_NewRef) to pto->args, pto->kw, and pto->fn before iterating/using them. This ensures the underlying objects remain alive even if user code mutates the partial via __setstate__() during formatting.

The same pattern is applied to:

• pto->args: The positional arguments tuple iterated in the loop
• pto->kw: The keyword arguments dict iterated via PyDict_Next
• pto->fn: The callable whose __repr__ is invoked via %R

Reproducer (from the issue)

import gc
from functools import partial

g_partial = None

class EvilObject:
    def __init__(self, name, is_trigger=False):
        self.name = name
        self.is_trigger = is_trigger
        self.triggered = False

    def __repr__(self):
        global g_partial
        if self.is_trigger and not self.triggered and g_partial is not None:
            self.triggered = True
            new_state = (lambda x: x, ("replaced",), {}, None)
            g_partial.__setstate__(new_state)
            gc.collect()
        return f"EvilObject({self.name})"

evil1 = EvilObject("trigger", is_trigger=True)
evil2 = EvilObject("victim1")
evil3 = EvilObject("victim2")

p = partial(lambda: None, evil1, evil2, evil3)
g_partial = p
del evil1, evil2, evil3

repr(p)  # heap-buffer-overflow without fix

Fixes #144475.

• Issue: heap-buffer-overflow in functools.partial.__repr__() #144475