Bug report
Bug description:
The C implementation of bytearray.take_bytes() reads the size before calling
the argument's __index__(), then uses that stale size for the bounds check and
the buffer reads, so an __index__ that resizes the bytearray reads freed
memory (a use-after-free; segfaults on a debug build).
b = bytearray(b'A' * (16 * 1024 * 1024))
class Evil:
def __index__(self):
b.clear()
return 8 * 1024 * 1024
b.take_bytes(Evil()) # use-after-free
bytearray.__setitem__ re-reads the size after __index__ (GH-91153).
CPython versions tested on:
3.15, 3.16
Operating systems tested on:
macOS