fix Python implementation

Author: picnixz

Lib/asyncio/futures.py

@@ -234,10 +234,11 @@ def remove_done_callback(self, fn):
 
         Returns the number of callbacks removed.
         """
+        count = len(self._callbacks)  # since filtering may mutate the list
         filtered_callbacks = [(f, ctx)
                               for (f, ctx) in self._callbacks
                               if f != fn]
-        removed_count = len(self._callbacks) - len(filtered_callbacks)
+        removed_count = count - len(filtered_callbacks)
         if removed_count:
             self._callbacks[:] = filtered_callbacks
         return removed_count

Lib/test/test_asyncio/test_futures.py

@@ -933,6 +933,7 @@ def test_use_after_free_fixed(self):
         # Special thanks to Nico-Posada for the original PoC.
         # See https://github.com/python/cpython/issues/125789.
 
+        asserter = self
         fut = self._new_future()
 
         class cb_pad:
@@ -941,11 +942,13 @@ def __eq__(self, other):
 
         class evil(cb_pad):
             def __eq__(self, other):
-                fut.remove_done_callback(None)
+                removed = fut.remove_done_callback(None)
+                asserter.assertEqual(removed, 1)
                 return NotImplemented
 
         fut.add_done_callback(cb_pad())
-        fut.remove_done_callback(evil())
+        removed = fut.remove_done_callback(evil())
+        self.assertEqual(removed, 1)
 
 
 @unittest.skipUnless(hasattr(futures, '_CFuture'),