[New-bugs-announce] [issue18328] Use after free in pystate.c

[Christian Heimes]

New submission from Christian Heimes:

Coverity doesn't like the code in and I think it's right. Can somebody look into the matter and check Python 3.3, too?

http://hg.python.org/cpython/file/ac7bc6700ac3/Python/pystate.c#l376
http://hg.python.org/cpython/file/ac7bc6700ac3/Python/pystate.c#l394

10. freed_arg: "tstate_delete_common(PyThreadState *)" frees "tstate". 

395    tstate_delete_common(tstate);
   
11. Condition "autoInterpreterState", taking true branch
   
CID 1019639 (#1 of 1): Use after free (USE_AFTER_FREE)12. use_after_free: Using freed pointer "tstate".
396    if (autoInterpreterState && PyThread_get_key_value(autoTLSkey) == tstate)
397        PyThread_delete_key_value(autoTLSkey);

----------
components: Interpreter Core
messages: 192043
nosy: christian.heimes
priority: normal
severity: normal
stage: test needed
status: open
title: Use after free in pystate.c
type: behavior
versions: Python 3.3, Python 3.4

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue18328>
_______________________________________