Skip to content

Commit fa80517

Browse files
colesburySonicField
authored andcommitted
pythongh-118561: Fix crash involving list.extend in free-threaded build (python#118723)
The `list_preallocate_exact` function did not zero initialize array contents. In the free-threaded build, this could expose uninitialized memory to concurrent readers between the call to `list_preallocate_exact` and the filling of the array contents with items.
1 parent 63af4b5 commit fa80517

File tree

2 files changed

+4
-1
lines changed

2 files changed

+4
-1
lines changed
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Fix race condition in free-threaded build where :meth:`list.extend` could expose
2+
uninitialied memory to concurrent readers.

Objects/listobject.c

+2-1
Original file line numberDiff line numberDiff line change
@@ -192,14 +192,15 @@ list_preallocate_exact(PyListObject *self, Py_ssize_t size)
192192
return -1;
193193
}
194194
items = array->ob_item;
195+
memset(items, 0, size * sizeof(PyObject *));
195196
#else
196197
items = PyMem_New(PyObject*, size);
197198
if (items == NULL) {
198199
PyErr_NoMemory();
199200
return -1;
200201
}
201202
#endif
202-
self->ob_item = items;
203+
FT_ATOMIC_STORE_PTR_RELEASE(self->ob_item, items);
203204
self->allocated = size;
204205
return 0;
205206
}

0 commit comments

Comments
 (0)