gh-148688: Fix _BlocksOutputBuffer_Finish() double free (#148689)

vstinner · web-flow · commit d61fcf834d19 · 2026-04-18T09:56:56.000Z
If _BlocksOutputBuffer_Finish() fails (memory allocation failure),
PyBytesWriter_Discard() is called on the writer. Then if
_BlocksOutputBuffer_OnError() is called, it calls again
PyBytesWriter_Discard() causing a double free.

Fix _BlocksOutputBuffer_Finish() by setting buffer-&gt;writer to NULL,
so _BlocksOutputBuffer_OnError() does nothing instead of calling
PyBytesWriter_Discard() again.
diff --git a/Include/internal/pycore_blocks_output_buffer.h b/Include/internal/pycore_blocks_output_buffer.h
@@ -242,9 +242,12 @@ static inline PyObject *
 _BlocksOutputBuffer_Finish(_BlocksOutputBuffer *buffer,
                            const Py_ssize_t avail_out)
 {
+    PyObject *obj;
     assert(buffer->writer != NULL);
-    return PyBytesWriter_FinishWithSize(buffer->writer,
-                                        buffer->allocated - avail_out);
+    obj = PyBytesWriter_FinishWithSize(buffer->writer,
+                                       buffer->allocated - avail_out);
+    buffer->writer = NULL;
+    return obj;
 }
 
 /* Clean up the buffer when an error occurred. */
diff --git a/Misc/NEWS.d/next/Library/2026-04-17-16-31-58.gh-issue-148688.vVugFn.rst b/Misc/NEWS.d/next/Library/2026-04-17-16-31-58.gh-issue-148688.vVugFn.rst
@@ -0,0 +1,2 @@
+:mod:`bz2`, :mod:`compression.zstd`, :mod:`lzma`, :mod:`zlib`: Fix a double
+free on memory allocation failure. Patch by Victor Stinner.

Original file line number	Diff line number	Diff line change
`@@ -242,9 +242,12 @@ static inline PyObject *`
`242`	`242`	`_BlocksOutputBuffer_Finish(_BlocksOutputBuffer *buffer,`
`243`	`243`	`const Py_ssize_t avail_out)`
`244`	`244`	`{`
	`245`	`+ PyObject *obj;`
`245`	`246`	`assert(buffer->writer != NULL);`
`246`		`- return PyBytesWriter_FinishWithSize(buffer->writer,`
`247`		`- buffer->allocated - avail_out);`
	`247`	`+ obj = PyBytesWriter_FinishWithSize(buffer->writer,`
	`248`	`+ buffer->allocated - avail_out);`
	`249`	`+ buffer->writer = NULL;`
	`250`	`+ return obj;`
`248`	`251`	`}`
`249`	`252`
`250`	`253`	`/* Clean up the buffer when an error occurred. */`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	+:mod:`bz2`, :mod:`compression.zstd`, :mod:`lzma`, :mod:`zlib`: Fix a double
	`2`	`+free on memory allocation failure. Patch by Victor Stinner.`