Issue 24091: Use after free in Element.extend (1) (original) (raw)

# 1055 for (i = 0; i < seqlen; i++) {

(gdb) n

# 1056 PyObject* element = PySequence_Fast_GET_ITEM(seq, i);

(gdb) n

# 1057 if (!PyObject_IsInstance(element, (PyObject *)&Element_Type)) {

(gdb) print *element

$19 = {_ob_next = 0x4060e6fc, _ob_prev = 0x4056cd8c, ob_refcnt = 1, ob_type = 0x406de3e4}

(gdb) n

# 1066 if (element_add_subelement(self, element) < 0) {

(gdb) print *element

$20 = {_ob_next = 0xdbdbdbdb, _ob_prev = 0xdbdbdbdb, ob_refcnt = -606348325, ob_type = 0xdbdbdbdb}

Fatal Python error: /home/p/Python-3.4.1/Modules/_elementtree.c:267 object at 0x4056c4cc has negative ref count -606348326

"element" is removed in getattribute method.