From e9bde21b6a1545c5d3c5d06adae25e4bb384a306 Mon Sep 17 00:00:00 2001 From: Jelle Zijlstra Date: Thu, 22 Oct 2026 15:26:16 -0700 Subject: [PATCH] gh-159739: Keep descriptor metadata dictionaries alive during insertion (GH-160193) The classmethod and staticmethod metadata setters dropped their reference to the descriptor dictionary before inserting the new value. A key comparison or value finalizer can replace the dictionary during insertion, leaving the operation using released memory. Keep the dictionary alive until insertion finishes. Backport to 3.15 and 3.14. (cherry picked from commit a076a55ad2a318cd8b7010d85ccf21ccd0a98555) Co-authored-by: Jelle Zijlstra --- .../2026-10-21-21-26-10.gh-issue-159739.CbTE4N.rst | 1 + Objects/funcobject.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-10-21-21-26-10.gh-issue-159739.CbTE4N.rst diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-10-21-21-26-10.gh-issue-159739.CbTE4N.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-10-21-21-26-10.gh-issue-159739.CbTE4N.rst new file mode 100644 index 000000000000000..20072791808dd1f --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-10-21-21-26-10.gh-issue-159739.CbTE4N.rst @@ -0,0 +1 @@ +Fix a possible crash when assigning metadata to :class:`classmethod` or :class:`staticmethod` objects. diff --git a/Objects/funcobject.c b/Objects/funcobject.c index 0481adadf668f8d..9cac2e77845a4f8 100644 --- a/Objects/funcobject.c +++ b/Objects/funcobject.c @@ -1465,8 +1465,9 @@ descriptor_set_wrapped_attribute(PyObject *oobj, PyObject *name, PyObject *value return 0; } else { + int result = PyDict_SetItem(dict, name, value); Py_DECREF(dict); - return PyDict_SetItem(dict, name, value); + return result; } }