Issue 24097: Use after free in PyObject_GetState

# Program received signal SIGSEGV, Segmentation fault.
# 0x080f27b2 in PyObject_Hash (v=<unknown at remote 0x405720e4>) at Objects/object.c:746
# 746         if (tp->tp_hash != NULL)
# (gdb) bt
# #0  0x080f27b2 in PyObject_Hash (v=<unknown at remote 0x405720e4>) at Objects/object.c:746
# #1  0x080e1717 in PyDict_SetItem (op={}, key=<unknown at remote 0x405720e4>, value=None) at Objects/dictobject.c:1201
# #2  0x0810e8a0 in _PyObject_GetState (obj=<Y at remote 0x405731bc>) at Objects/typeobject.c:3657
# #3  0x081100e9 in reduce_2 (obj=<Y at remote 0x405731bc>) at Objects/typeobject.c:3949
# #4  0x08110551 in _common_reduce (self=<Y at remote 0x405731bc>, proto=2) at Objects/typeobject.c:4012
# #5  0x08110641 in object_reduce (self=<Y at remote 0x405731bc>, args=(2,)) at Objects/typeobject.c:4032
# 
# (gdb) frame 2
# #2  0x0810e8a0 in _PyObject_GetState (obj=<Y at remote 0x405731bc>) at Objects/typeobject.c:3657
# 3657                        int err = PyDict_SetItem(slots, name, value);
# (gdb) print *name
# $1 = {_ob_next = 0xdbdbdbdb, _ob_prev = 0xdbdbdbdb, ob_refcnt = -606348325, ob_type = 0xdbdbdbdb}
# 
# "name" is freed inside __getattr__ and is later used by PyDict_SetItem.

ping

Thanks for the report. Here is a patch.

lgtm

The fix LGTM.

It would be nice to add a test.

Here is a test for this issue.

In 2.7 the test doesn't crash, but __reduce__ produces invalid recursive structure.

Here is backported to 2.7 patch with test. Can you review the test and commit the patch Antoine?

New changeset eed36e19f8b8 by Serhiy Storchaka in branch '3.4':
Issue #24097: Fixed crash in object.__reduce__() if slot name is freed inside
https://hg.python.org/cpython/rev/eed36e19f8b8

New changeset 99839a1c9c6d by Serhiy Storchaka in branch '3.5':
Issue #24097: Fixed crash in object.__reduce__() if slot name is freed inside
https://hg.python.org/cpython/rev/99839a1c9c6d

New changeset 502465d22522 by Serhiy Storchaka in branch 'default':
Issue #24097: Fixed crash in object.__reduce__() if slot name is freed inside
https://hg.python.org/cpython/rev/502465d22522

New changeset 4a201d0d4d1e by Serhiy Storchaka in branch '2.7':
Issue #24097: Fixed crash in object.__reduce__() if slot name is freed inside
https://hg.python.org/cpython/rev/4a201d0d4d1e

messages: + msg246949
stage: test needed -> patch review