From e031e9bd26477edce353fbca63f4ce1d6196847d Mon Sep 17 00:00:00 2001 From: Jelle Zijlstra Date: Wed, 21 Oct 2026 21:29:33 -0700 Subject: [PATCH] gh-159739: Keep descriptor metadata dictionaries alive during insertion The classmethod and staticmethod metadata setters dropped their reference to the descriptor dictionary before inserting the new value. A key comparison or value finalizer can replace the dictionary during insertion, leaving the operation using released memory. Keep the dictionary alive until insertion finishes. Backport to 3.15 and 3.14. --- .../2026-10-21-21-26-10.gh-issue-159739.CbTE4N.rst | 1 + Objects/funcobject.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-10-21-21-26-10.gh-issue-159739.CbTE4N.rst diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-10-21-21-26-10.gh-issue-159739.CbTE4N.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-10-21-21-26-10.gh-issue-159739.CbTE4N.rst new file mode 100644 index 000000000000000..20072791808dd1f --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-10-21-21-26-10.gh-issue-159739.CbTE4N.rst @@ -0,0 +1 @@ +Fix a possible crash when assigning metadata to :class:`classmethod` or :class:`staticmethod` objects. diff --git a/Objects/funcobject.c b/Objects/funcobject.c index f4adaf390e0cf93..d5caa7fceb05be5 100644 --- a/Objects/funcobject.c +++ b/Objects/funcobject.c @@ -1460,8 +1460,9 @@ descriptor_set_wrapped_attribute(PyObject *oobj, PyObject *name, PyObject *value return 0; } else { + int result = PyDict_SetItem(dict, name, value); Py_DECREF(dict); - return PyDict_SetItem(dict, name, value); + return result; } }