gh-156995: Fix `bytearray.take_bytes()` corrupting shared single-byte bytes objects by StanFromIreland · Pull Request #156996 · python/cpython · GitHub
Skip to content

gh-156995: Fix bytearray.take_bytes() corrupting shared single-byte bytes objects - #156996

Open
StanFromIreland wants to merge 4 commits into
python:mainfrom
StanFromIreland:bytearray.take_bytes
Open

gh-156995: Fix bytearray.take_bytes() corrupting shared single-byte bytes objects#156996
StanFromIreland wants to merge 4 commits into
python:mainfrom
StanFromIreland:bytearray.take_bytes

Conversation

@StanFromIreland

@StanFromIreland StanFromIreland commented Sep 5, 2026

Copy link
Copy Markdown
Member

@cmaloney cmaloney left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Double checking against implementation this change looks correct.

I think should add an assert as a safety net to help catch this bug into bytearray_reinit_from_bytes which is called every time self->ob_bytes_object is set to re-init.

bytearray_reinit_from_bytes(PyByteArrayObject *self, Py_ssize_t size,
                            Py_ssize_t alloc)
{
    /* Only the empty bytes may be immortal. */
    assert((alloc == 0) == _Py_IsImmortal(self->ob_bytes_object));

That safety net in free-threaded builds finds an additional case that can happen. _PyBytes_Resize uses _PyObject_IsUniquelyReferenced which under free threading includes that the object is owned by the current thread. If another thread swapped out the underlying bytes the unquiely reference returns false. if it is a downsize that calls PyBytes_FromStringAndSize which passes non-NULL to its first parameter...

Not sure the best way to fix that... I'd lean that _PyBytes_Resize should never return an immutable object for size >= 1 as that can lead to a really subtle only under free-threading bug...

Co-authored-by: Cody Maloney <cmaloney@theoreticalchaos.com>
@StanFromIreland

Copy link
Copy Markdown
Member Author

@cmaloney cmaloney left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc: @vstinner would be good to get more eyes on the _PyBytes_Resize part in particular as this would be nice to get into 3.15

@StanFromIreland

Copy link
Copy Markdown
Member Author

Comment thread Objects/bytearrayobject.c Outdated
Co-authored-by: Cody Maloney <cmaloney@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

awaiting core review needs backport to 3.15 pre-release feature fixes, bugs and security fixes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants