GeezerVison

Summary

get_suggestions_for_attribute_error(), offer_suggestions_for_name_error() and
offer_suggestions_for_import_error() in Python/suggestions.c use borrowed
references to exc->name / exc->obj / exc->name_from and to the traceback
frame across calls that can run arbitrary Python code:

• PyObject_Dir(obj) / PyObject_Dir(mod) → __dir__
• PyImport_GetModule(mod_name) → sys.modules overrides
• _PyObject_LookupAttr(self, name, ...) → __getattr__/__getattribute__

That code can rebind or clear the exception's attributes (exc.name = ...,
exc.obj = None, exc.__traceback__ = None) and free the referenced objects.
calculate_suggestions() then dereferences the dangling pointers →
use-after-free (deterministic SIGSEGV when the freed name is a large,
mmap-backed string; reproducer in gh-157947).

This only affects 3.12 — the AttributeError suggestion path was refactored
away on 3.13/main.

The fix takes strong references to name, obj, mod_name, name_from and
frame for the duration of the calls that may execute arbitrary code.

Reproducer

import sys

def fresh_name():
    return ("X" * (4 * 1024 * 1024)) + "!"   # mmap'd -> munmap on free

class Evil:
    def __dir__(self):
        exc = getattr(sys, "last_value", None)
        if isinstance(exc, AttributeError):
            exc.name = "replaced"; exc.obj = None
        return ["x"]

raise AttributeError("boom", name=fresh_name(), obj=Evil())

On the 3.12 branch this segfaults during exception printing
(unpatched_exit=139); with the patch the exception prints normally.

Tests

• New regression test test_attribute_error_name_cleared_in_dir in
  Lib/test/test_traceback.py (runs in both the pure-Python and the
  _testcapi exception-printing variants).
• All 58 tests in {Pure,CPython}SuggestionFormattingTests pass.