Skip to content

gh-158032: Keep the element tag alive during Element.iter comparison - #158044

Open
lul-cas wants to merge 2 commits into
python:mainfrom
lul-cas:fix-issue-158032
Open

lul-cas wants to merge 2 commits into
python:mainfrom
lul-cas:fix-issue-158032

Conversation

@lul-cas

@lul-cas lul-cas commented Sep 23, 2026 •

Copy link
Copy Markdown
Contributor

Element.iter compared each element's tag through a borrowed reference. A reentrant eq can replace that tag and free it while the comparison is still using it.

Hold a strong reference for the duration of PyObject_RichCompareBool, as Element.find already does.

Fixes #158032.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

uaf in _elementtree Element.iter(tag)

1 participant