gh-146613: Fix re-entrant use-after-free in itertools._grouper by TheSkyC · Pull Request #147962 · python/cpython

TheSkyC · 2026-04-01T11:03:21Z

The same pattern was fixed in groupby.__next__ (gh-143543 / a91b5c3), but _grouper_next (the inner group iterator returned by groupby) was missed.

A user-defined __eq__ can re-enter the grouper during PyObject_RichCompareBool, causing Py_XSETREF to free currkey while it is still being used.

Fixed by taking strong references (Py_INCREF / Py_DECREF) to tgtkey and currkey before the comparison, exactly as done in groupby_next.

Added regression test test_grouper_reentrant_eq_does_not_crash.

The same pattern was fixed in groupby.__next__ (pythongh-143543 / a91b5c3), but _grouper_next (the inner group iterator returned by groupby) was missed. A user-defined __eq__ can re-enter the grouper during PyObject_RichCompareBool, causing Py_XSETREF to free currkey while it is still being used. Fix by taking local snapshots of tgtkey/currkey + INCREF/DECREF protection, exactly as done in groupby_next. Added regression test in test_itertools.py.

bedevere-app · 2026-04-01T11:03:25Z

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

python-cla-bot · 2026-04-01T11:03:25Z

All commit authors signed the Contributor License Agreement.

TheSkyC · 2026-04-01T12:18:47Z

Hi @vstinner,
I've addressed your review comments in the latest commit
Thanks for your guidance!

vstinner

LGTM.

I confirm that the test does crash without the fix, and does pass successfully with the fix.

…zjUFK.rst Co-authored-by: Victor Stinner <vstinner@python.org>

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

…zjUFK.rst Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

vstinner · 2026-04-01T13:24:53Z

Lint CI job failed with:

 error[: unpinned action reference
--> .github/workflows/reusable-check-html-ids.yml:19:15
|
19 | uses: actions/checkout@v6
| ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)

It's unrelated to this change. I reported the issue to: #145632 (comment).

TheSkyC · 2026-04-01T13:42:12Z

Thanks for reporting the issue, @vstinner! Should I update the branch from main to fix it?

vstinner · 2026-04-01T13:43:16Z

Thanks for reporting the issue, @vstinner! Should I update the branch from main to fix it?

The issue is not fixed yet, so there is no need to update your branch.

vstinner · 2026-04-01T14:00:57Z

#147968 will fix the Lint CI.

miss-islington-app · 2026-04-02T13:35:02Z

Thanks @TheSkyC for the PR, and @kumaraditya303 for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

pythonGH-147962) (cherry picked from commit fc7a188) Co-authored-by: Ma Yukun <68433685+TheSkyC@users.noreply.github.com>

bedevere-app · 2026-04-02T13:35:12Z

GH-148010 is a backport of this pull request to the 3.14 branch.

pythonGH-147962) (cherry picked from commit fc7a188) Co-authored-by: Ma Yukun <68433685+TheSkyC@users.noreply.github.com>

bedevere-app · 2026-04-02T13:35:16Z

GH-148011 is a backport of this pull request to the 3.13 branch.

…r` (GH-147962) (#148010) gh-146613: Fix re-entrant use-after-free in `itertools._grouper` (GH-147962) (cherry picked from commit fc7a188) Co-authored-by: Ma Yukun <68433685+TheSkyC@users.noreply.github.com>

…r` (GH-147962) (#148011) gh-146613: Fix re-entrant use-after-free in `itertools._grouper` (GH-147962) (cherry picked from commit fc7a188) Co-authored-by: Ma Yukun <68433685+TheSkyC@users.noreply.github.com>

python#147962)

TheSkyC requested a review from rhettinger as a code owner April 1, 2026 11:03

bedevere-appBot mentioned this pull request Apr 1, 2026
itertools._grouper.__next__ has the same re-entrant use-after-free that was fixed in groupby.__next__#146613
Closed

bedevere-appBot added the awaiting review label Apr 1, 2026

📜🤖 Added by blurb_it.
1b647a1

vstinner reviewed Apr 1, 2026
View reviewed changes

Comment threadLib/test/test_itertools.py Outdated
Comment threadLib/test/test_itertools.py Outdated
Comment threadLib/test/test_itertools.py Outdated
Comment threadMisc/NEWS.d/next/Library/2026-04-01-11-05-36.gh-issue-146613.GzjUFK.rst Outdated

TheSkyC added 2 commits April 1, 2026 19:54

address review comments from@vstinner
f1d2d2a

fix trailing whitespace in test_itertools
a7aa2ce

vstinner approved these changes Apr 1, 2026
View reviewed changes

Comment threadMisc/NEWS.d/next/Library/2026-04-01-11-05-36.gh-issue-146613.GzjUFK.rst Outdated

bedevere-appBot added awaiting merge and removed awaiting review labels Apr 1, 2026

Update Misc/NEWS.d/next/Library/2026-04-01-11-05-36.gh-issue-146613.G…
895b685
…zjUFK.rst Co-authored-by: Victor Stinner <vstinner@python.org>

vstinner enabled auto-merge (squash) April 1, 2026 13:00

vstinner added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Apr 1, 2026

picnixz reviewed Apr 1, 2026
View reviewed changes

Comment threadMisc/NEWS.d/next/Library/2026-04-01-11-05-36.gh-issue-146613.GzjUFK.rst Outdated

picnixz reviewed Apr 1, 2026
View reviewed changes

Comment threadModules/itertoolsmodule.c Outdated

Update Modules/itertoolsmodule.c
fef6412
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

auto-merge was automatically disabled April 1, 2026 13:16
Head branch was pushed to by a user without write access

Update Misc/NEWS.d/next/Library/2026-04-01-11-05-36.gh-issue-146613.G…
fd9b831
…zjUFK.rst Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

vstinner mentioned this pull request Apr 1, 2026
gh-145000: Run check-html-ids.py in CI #145632
Merged

Merge branch 'main' intopythongh-146613-itertools-uaf
5c9ff8b

kumaraditya303 approved these changes Apr 2, 2026
View reviewed changes

kumaraditya303 merged commit fc7a188 into python:mainApr 2, 2026
54 checks passed

bedevere-appBot removed the awaiting merge label Apr 2, 2026

bedevere-appBot removed the needs backport to 3.14 bugs and security fixes label Apr 2, 2026

bedevere-appBot removed the needs backport to 3.13 bugs and security fixes label Apr 2, 2026

pablogsal mentioned this pull request Apr 4, 2026
gh-130273: Fix traceback color output with unicode characters #142529
Merged

ljfp pushed a commit to ljfp/cpython that referenced this pull request Apr 25, 2026
pythongh-146613: Fix re-entrant use-after-free initertools._grouper(
7c4fe17
python#147962)

Uh oh!

Uh oh!

Conversation

TheSkyC commented Apr 1, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bedevere-appBot commented Apr 1, 2026

Uh oh!

python-cla-botBot commented Apr 1, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TheSkyC commented Apr 1, 2026

Uh oh!

vstinner left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vstinner commented Apr 1, 2026

Uh oh!

TheSkyC commented Apr 1, 2026

Uh oh!

vstinner commented Apr 1, 2026

Uh oh!

vstinner commented Apr 1, 2026

Uh oh!

Uh oh!

miss-islington-appBot commented Apr 2, 2026

Uh oh!

bedevere-appBot commented Apr 2, 2026

Uh oh!

bedevere-appBot commented Apr 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

TheSkyC commented Apr 1, 2026•
edited
Loading

python-cla-botBot commented Apr 1, 2026•
edited
Loading