aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/Python/pystate.c
diff options
context:
space:
mode:
authorb-pass <b-pass@users.noreply.github.com>2025-05-18 11:02:29 -0400
committerGitHub <noreply@github.com>2025-05-18 20:32:29 +0530
commitf2de1e6861c27bd498f598efc01600450979b5f9 (patch)
tree09a00dce96c42e55f95115472c66ff7d8bcf952a /Python/pystate.c
parent0a160bf14c4848f50539e52e2de486c641d122a2 (diff)
downloadcpython-f2de1e6861c27bd498f598efc01600450979b5f9.tar.gz
cpython-f2de1e6861c27bd498f598efc01600450979b5f9.zip
gh-134144: Fix use-after-free in zapthreads() (#134145)
Diffstat (limited to 'Python/pystate.c')
-rw-r--r--Python/pystate.c9
1 files changed, 7 insertions, 2 deletions
diff --git a/Python/pystate.c b/Python/pystate.c
index 1ac13440085..14ae2748b0b 100644
--- a/Python/pystate.c
+++ b/Python/pystate.c
@@ -1908,9 +1908,14 @@ tstate_delete_common(PyThreadState *tstate, int release_gil)
static void
zapthreads(PyInterpreterState *interp)
{
+ PyThreadState *tstate;
/* No need to lock the mutex here because this should only happen
- when the threads are all really dead (XXX famous last words). */
- _Py_FOR_EACH_TSTATE_UNLOCKED(interp, tstate) {
+ when the threads are all really dead (XXX famous last words).
+
+ Cannot use _Py_FOR_EACH_TSTATE_UNLOCKED because we are freeing
+ the thread states here.
+ */
+ while ((tstate = interp->threads.head) != NULL) {
tstate_verify_not_active(tstate);
tstate_delete_common(tstate, 0);
free_threadstate((_PyThreadStateImpl *)tstate);