pythongh-126405: fix use-after-free in `_asyncio.Future.remove_done_c…

…allback` (pythonGH-126733) (cherry picked from commit 37c57df) Co-authored-by: Kumar Aditya <[email protected]>
miss-islington · Nov 12, 2024 · c70d59c · c70d59c
1 parent 4f1440f
commit c70d59c
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/Modules/_asynciomodule.c b/Modules/_asynciomodule.c
@@ -994,8 +994,10 @@ _asyncio_Future_remove_done_callback_impl(FutureObj *self, PyTypeObject *cls,
 
     if (len == 1) {
         PyObject *cb_tup = PyList_GET_ITEM(self->fut_callbacks, 0);
+        Py_INCREF(cb_tup);
         int cmp = PyObject_RichCompareBool(
             PyTuple_GET_ITEM(cb_tup, 0), fn, Py_EQ);
+        Py_DECREF(cb_tup);
         if (cmp == -1) {
             return NULL;
         }