Bug report

Bug description:

If you try to import something with a level >= 1 and it somehow fails to put it into sys.modules after importing, you'll get a nice error message letting you know.

However, this error message usesto_return which was freed a couple of lines before. Because it's used just after being freed, you can't do anything too malicious with it, but you can crash python by allocating a large enough string and having it be unmapped after being freed so that it's invalid memory when it's accessed.

(No crash but triggers ASAN with use-after-free)

importsyssys.modules= {f"a.b.c": {}}__import__(f"b.c", {"__package__":"a"},level=1)

(Crash)

importsysloooong="".ljust(0x100000,"b")sys.modules= {f"a.{loooong}.c": {}}__import__(f"{loooong}.c", {"__package__":"a"},level=1)

Fix is to have the decref after it makes the error message.

CPython versions tested on:

3.12, 3.13, 3.14

Operating systems tested on:

Windows, Linux

Linked PRs

• gh-134100: Fix UAF in PyImport_ImportModuleLevelObject #134117
• [3.14] gh-134100: Fix use-after-free inPyImport_ImportModuleLevelObject (GH-134117) #134171
• [3.13] gh-134100: Fix use-after-free inPyImport_ImportModuleLevelObject (GH-134117) #134172