Mar 29, 2025 · Apr 10, 2025 · May 17, 2025 · May 17, 2025 · May 18, 2025
diff --git a/Lib/test/test_bytes.py b/Lib/test/test_bytes.py
            with self.assertRaises(IndexError):
                self._testlimitedcapi.sequence_setitem(b, 0, Boom())

    def test_mutating_index_inbounds(self):
        # See gh-91153

        class MutatesOnIndex:
            new_ba: bytearray

            def __init__(self):
                self.ba = bytearray(0x180)

            def __index__(self):
                # Clear the original bytearray, mutating it during index assignment.
                # If the internal buffers are held over this operation, they become dangling
                # However, this will fail a bounds check as above (as the clear sets bounds to zero)
                self.ba.clear()
                # At this moment, the bytearray potentially has a dangling pointer
                # Create a new bytearray to catch any writes
                self.new_ba = bytearray(0x180)
                # Ensure bounds check passes
                self.ba.extend([0] * 0x180)
                return 0

        with self.subTest("skip_bounds_safety"):
            instance = MutatesOnIndex()
            instance.ba[instance] = ord("?")
            self.assertEqual(instance.ba[0], ord("?"), "Assigned bytearray not altered")
            self.assertEqual(instance.new_ba, bytearray(0x180), "Wrong object altered")

        with self.subTest("skip_bounds_safety_capi"):
            instance = MutatesOnIndex()
            instance.ba[instance] = ord("?")
            self._testlimitedcapi.sequence_setitem(instance.ba, instance, ord("?"))
            self.assertEqual(instance.ba[0], ord("?"), "Assigned bytearray not altered")
            self.assertEqual(instance.new_ba, bytearray(0x180), "Wrong object altered")

        with self.subTest("skip_bounds_safety_slice"):
            instance = MutatesOnIndex()
            instance.ba[instance:1] = [ord("?")]
            self.assertEqual(instance.ba[0], ord("?"), "Assigned bytearray not altered")
            self.assertEqual(instance.new_ba, bytearray(0x180), "Wrong object altered")


 class AssortedBytesTest(unittest.TestCase):
    #
diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2025-05-17-20-56-05.gh-issue-91153.afgtG2.rst b/Misc/NEWS.d/next/Core_and_Builtins/2025-05-17-20-56-05.gh-issue-91153.afgtG2.rst
 Fix an issue where a :class:`bytearray` item assignment could crash or write
 to the wrong bytearray when resized by the new value's
 :meth:`~object.__index__` method.
diff --git a/Objects/bytearrayobject.c b/Objects/bytearrayobject.c
    _Py_CRITICAL_SECTION_ASSERT_OBJECT_LOCKED(op);
    PyByteArrayObject *self = _PyByteArray_CAST(op);
    Py_ssize_t start, stop, step, slicelen;
    char *buf = PyByteArray_AS_STRING(self);
    // GH-91153: we cannot store a reference to the internal buffer here, as _getbytevalue might call into python code
    // that could then invalidate it.

    if (_PyIndex_Check(index)) {
        Py_ssize_t i = PyNumber_AsSsize_t(index, PyExc_IndexError);
        }
        else {
            assert(0 <= ival && ival < 256);
 buf[i] = (char)ival;
 PyByteArray_AS_STRING(self)[i] = (char)ival;
            return 0;
        }
    }
            /* Delete slice */
            size_t cur;
            Py_ssize_t i;
            char* buf = PyByteArray_AS_STRING(self);

            if (!_canresize(self))
                return -1;
            /* Assign slice */
            Py_ssize_t i;
            size_t cur;
            char* buf = PyByteArray_AS_STRING(self);

            if (needed != slicelen) {
                PyErr_Format(PyExc_ValueError,
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1889,6 +1889,46 @@ def __index__(self):
		with self.assertRaises(IndexError):
		self._testlimitedcapi.sequence_setitem(b, 0, Boom())

		def test_mutating_index_inbounds(self):
bast0006 marked this conversation as resolved. Show resolvedHide resolved
		# See gh-91153

		class MutatesOnIndex:
		new_ba: bytearray

		def __init__(self):
		self.ba = bytearray(0x180)

		def __index__(self):
		# Clear the original bytearray, mutating it during index assignment.
		# If the internal buffers are held over this operation, they become dangling
		# However, this will fail a bounds check as above (as the clear sets bounds to zero)
		self.ba.clear()
		# At this moment, the bytearray potentially has a dangling pointer
		# Create a new bytearray to catch any writes
		self.new_ba = bytearray(0x180)
		# Ensure bounds check passes
		self.ba.extend([0] * 0x180)
		return 0

		with self.subTest("skip_bounds_safety"):
		instance = MutatesOnIndex()
		instance.ba[instance] = ord("?")
		self.assertEqual(instance.ba[0], ord("?"), "Assigned bytearray not altered")
		self.assertEqual(instance.new_ba, bytearray(0x180), "Wrong object altered")

		with self.subTest("skip_bounds_safety_capi"):
		instance = MutatesOnIndex()
		instance.ba[instance] = ord("?")
		self._testlimitedcapi.sequence_setitem(instance.ba, instance, ord("?"))
		self.assertEqual(instance.ba[0], ord("?"), "Assigned bytearray not altered")
		self.assertEqual(instance.new_ba, bytearray(0x180), "Wrong object altered")

		with self.subTest("skip_bounds_safety_slice"):
		instance = MutatesOnIndex()
		instance.ba[instance:1] = [ord("?")]
		self.assertEqual(instance.ba[0], ord("?"), "Assigned bytearray not altered")
		self.assertEqual(instance.new_ba, bytearray(0x180), "Wrong object altered")


		class AssortedBytesTest(unittest.TestCase):
		#
Expand Down
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,3 @@
		Fix an issue where a :class:`bytearray` item assignment could crash or write
		to the wrong bytearray when resized by the new value's
		:meth:`~object.__index__` method.
Original file line number	Diff line number	Diff line change
Expand Up		@@ -709,7 +709,8 @@ bytearray_ass_subscript_lock_held(PyObject op, PyObject index, PyObject *value
		_Py_CRITICAL_SECTION_ASSERT_OBJECT_LOCKED(op);
		PyByteArrayObject *self = _PyByteArray_CAST(op);
		Py_ssize_t start, stop, step, slicelen;
		char *buf = PyByteArray_AS_STRING(self);
		// GH-91153: we cannot store a reference to the internal buffer here, as _getbytevalue might call into python code
		// that could then invalidate it.

		if (_PyIndex_Check(index)) {
		Py_ssize_t i = PyNumber_AsSsize_t(index, PyExc_IndexError);
Expand DownExpand Up		@@ -744,7 +745,7 @@ bytearray_ass_subscript_lock_held(PyObject op, PyObject index, PyObject *value
		}
		else {
		assert(0 <= ival && ival < 256);
		buf[i] = (char)ival;
		PyByteArray_AS_STRING(self)[i] = (char)ival;
		return 0;
		}
		}
Expand DownExpand Up		@@ -805,6 +806,7 @@ bytearray_ass_subscript_lock_held(PyObject op, PyObject index, PyObject *value
		/* Delete slice */
		size_t cur;
		Py_ssize_t i;
		char* buf = PyByteArray_AS_STRING(self);

		if (!_canresize(self))
		return -1;
Expand DownExpand Up		@@ -845,6 +847,7 @@ bytearray_ass_subscript_lock_held(PyObject op, PyObject index, PyObject *value
		/* Assign slice */
		Py_ssize_t i;
		size_t cur;
		char* buf = PyByteArray_AS_STRING(self);

		if (needed != slicelen) {
		PyErr_Format(PyExc_ValueError,
Expand Down