[New-bugs-announce] [issue30604] co_extra_freefuncs is stored thread locally and can lead to crashes

[Dino Viehland]

New submission from Dino Viehland:

The co_extra_freefuncs are stored in PyThreadState.  When calling _PyEval_RequestCodeExtraIndex you are given a thread specific index.  The code object can then lose it's last reference on a different thread, and the wrong free function can be called if users of the extra space have made calls to get their index in different orders.  

This can also lead to crashes if the extra thread hasn't yet requested extra indexes either.

----------
assignee: dino.viehland
components: Interpreter Core
keywords: patch
messages: 295467
nosy: brett.cannon, dino.viehland, yselivanov
priority: normal
severity: normal
stage: patch review
status: open
title: co_extra_freefuncs is stored thread locally and can lead to crashes
type: crash
versions: Python 3.6

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue30604>
_______________________________________