| commit | 557b05c7a5334de5da3dc94c108c0121f10b9191 | [log] [tgz] |
|---|---|---|
| author | Anders Kaseorg <andersk@mit.edu> | Tue Aug 01 02:32:18 2023 -0700 |
| committer | GitHub <noreply@github.com> | Tue Aug 01 10:32:18 2023 +0100 |
| tree | 84c4eaea106080031c7f7a1110b9ac546afb1b76 | |
| parent | 052a0d1106fa3ee0c955a3b7ba48e82c49424e20 [diff] |
gh-106092: Fix use-after-free crash in frame_dealloc (#106875) It was possible for the trashcan to delay the deallocation of a PyFrameObject until after its corresponding _PyInterpreterFrame has already been freed. So frame_dealloc needs to avoid dereferencing the f_frame pointer unless it first checks that the pointer still points to the interpreter frame within the frame object. Signed-off-by: Anders Kaseorg <andersk@mit.edu>