Summary

Fix a heap-buffer-overflow (use-after-free) infunctools.partial.__repr__() where a user-defined__repr__() on an argument could mutate the partial object via__setstate__(), freeing the args tuple whilepartial_repr() was still iterating over it.

Root Cause

partial_repr() captured the size ofpto->args before the loop and accessed tuple items via borrowed references (PyTuple_GET_ITEM). If a__repr__() called during%R formatting invokedpto.__setstate__() with a new (smaller) args tuple, the original tuple was freed while iteration continued, causing an out-of-bounds read.

Fix

Hold strong references (Py_NewRef) topto->args,pto->kw, andpto->fn before iterating/using them. This ensures the underlying objects remain alive even if user code mutates the partial via__setstate__() during formatting.

The same pattern is applied to:

• pto->args: The positional arguments tuple iterated in the loop
• pto->kw: The keyword arguments dict iterated viaPyDict_Next
• pto->fn: The callable whose__repr__ is invoked via%R

Reproducer (from the issue)

importgcfromfunctoolsimportpartialg_partial=NoneclassEvilObject:def__init__(self,name,is_trigger=False):self.name=nameself.is_trigger=is_triggerself.triggered=Falsedef__repr__(self):globalg_partialifself.is_triggerandnotself.triggeredandg_partialisnotNone:self.triggered=Truenew_state= (lambdax:x, ("replaced",), {},None)g_partial.__setstate__(new_state)gc.collect()returnf"EvilObject({self.name})"evil1=EvilObject("trigger",is_trigger=True)evil2=EvilObject("victim1")evil3=EvilObject("victim2")p=partial(lambda:None,evil1,evil2,evil3)g_partial=pdelevil1,evil2,evil3repr(p)# heap-buffer-overflow without fix

Fixes#144475.

• Issue:heap-buffer-overflow in functools.partial.__repr__() #144475