GeezerVison is showing github.com — [3.13] gh-142831: Fix use-after-free in json encoder during re-entrant mutation (gh-142851) by ashm-dev · Pull Request #150079 · python/cpython
Conversation
ashm-dev
commented
May 19, 2026
•
edited by bedevere-app
Bot
Loading
Uh oh!
There was an error while loading. Please reload this page.
Manual backport of #142851 to 3.13 (the bot couldn't cleanly cherry-pick due to refactors in main).
The fix had to be adapted because:
- In 3.13 the dict/list iteration loops were not yet extracted into the
_encoder_iterate_*_lock_held helpers introduced later in main. Added the Py_INCREF/Py_DECREF around each borrowed item/key/value inline in encoder_listencode_dict (both the PyMapping_Items and PyDict_Next paths) and encoder_listencode_list.
encoder_encode_key_value in 3.13 has a different signature (no dct parameter, different separator handling).
Only the two UAF regression tests from the original PR were included — test_current_indent_level from the surrounding context is unrelated to this fix and would require additional 3.14-only changes.
Built --with-pydebug and ran ./python -m test test_json -v locally — all 197 tests pass.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
… mutation (pythongh-142851)
User callbacks invoked during JSON encoding (e.g. the `default` callback or
a custom string encoder) can mutate or clear the dict or sequence being
encoded, invalidating borrowed references to items, keys, and values. Hold
strong references unconditionally while iterating.
Co-authored-by: Kumar Aditya <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
(cherry picked from commit 235fa72)
This was referenced May 19, 2026
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Reviewers
gpshead
gpshead approved these changes
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.