gh-112127: Fix use-after-free in atexit.unregister()

Lib/test/_test_atexit.py

@@ -135,6 +135,19 @@ def func():
  finally:
  atexit.unregister(func)
 
+ def test_eq_unregister_clear(self):
+ # Issue #112127: callback's __eq__ may call unregister or _clear
+ class Evil:
+ def __eq__(self, other):
+ action(other)
+ return NotImplemented
+
+ for action in atexit.unregister, lambda o: atexit._clear():
+ with self.subTest(action=action):
+ atexit.register(lambda: None)
+ atexit.unregister(Evil())
+ atexit._clear()
+
 
 if __name__ == "__main__":
  unittest.main()

Misc/ACKS

@@ -908,6 +908,7 @@ Jim Jewett
 Pedro Diaz Jimenez
 Orjan Johansen
 Fredrik Johansson
+Benjamin Johnson
 Benjamin K. Johnson
 Gregory K. Johnson
 Kent Johnson

Misc/NEWS.d/next/Library/2025-12-17-14-41-09.gh-issue-112127.13OHQk.rst

@@ -0,0 +1,2 @@
+Fix possible use-after-free in :func:`atexit.unregister` when the callback
+is unregistered during comparison.

Modules/atexitmodule.c

@@ -257,10 +257,11 @@ static int
 atexit_unregister_locked(PyObject *callbacks, PyObject *func)
 {
  for (Py_ssize_t i = 0; i < PyList_GET_SIZE(callbacks); ++i){
- PyObject *tuple = PyList_GET_ITEM(callbacks, i);
+ PyObject *tuple = Py_NewRef(PyList_GET_ITEM(callbacks, i));
  assert(PyTuple_CheckExact(tuple));
  PyObject *to_compare = PyTuple_GET_ITEM(tuple, 0);
  int cmp = PyObject_RichCompareBool(func, to_compare, Py_EQ);
+ Py_DECREF(tuple);
  if (cmp < 0)
 {
  return -1;