Possible to double deref when exiting a context

[AZero13]

Crash report

What happened?

There was a Use-After-Free and double-decref bug in _PyContext_Exit() in Python/context.c. The function was calling Py_SETREF(ts->context, (PyObject *)ctx->ctx_prev) before clearing the ctx->ctx_prev and ctx->ctx_entered internal states.

CPython versions tested on:

CPython main branch

Operating systems tested on:

macOS

Output from running 'python -VV' on the command line:

No response

Linked PRs

• gh-157015: Fix double-decref in PyContext_Exit() #157016

[cmaloney]

Looking at the PR there is an explicit Py_DECREF(ctx) before the PyContext_Exit(ctx) at which point calling PyContext_Exit isn't valid (the function doesn't own a reference). In general using the C API have to be really careful with references.

[picnixz]

AFAICT, the bug is in the test itself. You can't DECREF and expect the next calls to the C API to work.