gh-143379: fix UAF in struct.Struct.pack() when object modified by dunder methods

Include/internal/pycore_pyatomic_ft_wrappers.h

@@ -107,6 +107,8 @@ extern "C" {
     _Py_atomic_store_ulong_relaxed(&value, new_value)
 #define FT_ATOMIC_STORE_SSIZE_RELAXED(value, new_value) \
     _Py_atomic_store_ssize_relaxed(&value, new_value)
+#define FT_ATOMIC_STORE_SSIZE(value, new_value) \
+    _Py_atomic_store_ssize(&value, new_value)
 #define FT_ATOMIC_STORE_FLOAT_RELAXED(value, new_value) \
     _Py_atomic_store_float_relaxed(&value, new_value)
 #define FT_ATOMIC_LOAD_FLOAT_RELAXED(value) \
@@ -151,6 +153,7 @@ extern "C" {
 #define FT_ATOMIC_STORE_INT8_RELAXED(value, new_value) value = new_value
 #define FT_ATOMIC_STORE_INT8_RELEASE(value, new_value) value = new_value
 #define FT_ATOMIC_STORE_SSIZE_RELAXED(value, new_value) value = new_value
+#define FT_ATOMIC_STORE_SSIZE(value, new_value) value = new_value
 #define FT_ATOMIC_STORE_SSIZE_RELEASE(value, new_value) value = new_value
 #define FT_ATOMIC_STORE_UINT8_RELAXED(value, new_value) value = new_value
 #define FT_ATOMIC_STORE_UINT16_RELAXED(value, new_value) value = new_value

Lib/test/test_struct.py

@@ -579,7 +579,7 @@ def test_Struct_reinitialization(self):
 
     def check_sizeof(self, format_str, number_of_codes):
         # The size of 'PyStructObject'
-        totalsize = support.calcobjsize('2n3P')
+        totalsize = support.calcobjsize('2n3P1n')
         # The size taken up by the 'formatcode' dynamic array
         totalsize += struct.calcsize('P3n0P') * (number_of_codes + 1)
         support.check_sizeof(self, struct.Struct(format_str), totalsize)
@@ -816,6 +816,19 @@ def test_endian_table_init_subinterpreters(self):
             results = executor.map(exec, [code] * 5)
             self.assertListEqual(list(results), [None] * 5)
 
+    def test_Struct_object_mutation_via_dunders(self):
+        S = struct.Struct('?I')
+        buf = array.array('b', b' '*100)
+
+        class Evil():
+            def __bool__(self):
+                # This rebuilds format codes during S.pack().
+                S.__init__('I')
+                return True
+
+        self.assertRaises(RuntimeError, S.pack, Evil(), 1)
+        self.assertRaises(RuntimeError, S.pack_into, buf, 0, Evil(), 1)
+
 
 class UnpackIteratorTest(unittest.TestCase):
     """

Misc/NEWS.d/next/Library/2026-01-03-10-15-32.gh-issue-143379.iz-hU7.rst

@@ -0,0 +1,4 @@
+Fix use-after-free in :meth:`struct.Struct.pack` when the
+:class:`struct.Struct` object is mutated by dunder methods (like
+:meth:`object.__bool__`) during packing of arguments.  Now this trigger
+:exc:`RuntimeError`.  Patch by Sergey B Kirpichev.

Modules/_struct.c

@@ -70,6 +70,7 @@ typedef struct {
     formatcode *s_codes;
     PyObject *s_format;
     PyObject *weakreflist; /* List of weak references */
+    Py_ssize_t mutex_cnt; /* to prevent mutation during packing */
 } PyStructObject;
 
 #define PyStructObject_CAST(op)     ((PyStructObject *)(op))
@@ -1773,6 +1774,7 @@ s_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
         s->s_codes = NULL;
         s->s_size = -1;
         s->s_len = -1;
+        s->mutex_cnt = 0;
     }
     return self;
 }
@@ -1816,6 +1818,11 @@ Struct___init___impl(PyStructObject *self, PyObject *format)
 
     Py_SETREF(self->s_format, format);
 
+    if (FT_ATOMIC_LOAD_SSIZE(self->mutex_cnt)) {
+        PyErr_SetString(PyExc_RuntimeError,
+                        "Call Struct.__init__() in struct.pack()");
+        return -1;
+    }
     ret = prepare_s(self);
     return ret;
 }
@@ -2139,7 +2146,7 @@ Struct_iter_unpack_impl(PyStructObject *self, PyObject *buffer)
  * argument for where to start processing the arguments for packing, and a
  * character buffer for writing the packed string.  The caller must insure
  * that the buffer may contain the required length for packing the arguments.
- * 0 is returned on success, 1 is returned if there is an error.
+ * 0 is returned on success, -1 is returned if there is an error.
  *
  */
 static int
@@ -2259,10 +2266,15 @@ s_pack(PyObject *self, PyObject *const *args, Py_ssize_t nargs)
     char *buf = PyBytesWriter_GetData(writer);
 
     /* Call the guts */
+    Py_ssize_t prev_cnt = FT_ATOMIC_LOAD_SSIZE(soself->mutex_cnt);
+
+    FT_ATOMIC_ADD_SSIZE(soself->mutex_cnt, 1);
     if ( s_pack_internal(soself, args, 0, buf, state) != 0 ) {
+        FT_ATOMIC_STORE_SSIZE(soself->mutex_cnt, prev_cnt);
         PyBytesWriter_Discard(writer);
         return NULL;
     }
+    FT_ATOMIC_STORE_SSIZE(soself->mutex_cnt, prev_cnt);
 
     return PyBytesWriter_FinishWithSize(writer, soself->s_size);
 }
@@ -2360,10 +2372,15 @@ s_pack_into(PyObject *self, PyObject *const *args, Py_ssize_t nargs)
     }
 
     /* Call the guts */
+    Py_ssize_t prev_cnt = FT_ATOMIC_LOAD_SSIZE(soself->mutex_cnt);
+
+    FT_ATOMIC_ADD_SSIZE(soself->mutex_cnt, 1);
     if (s_pack_internal(soself, args, 2, (char*)buffer.buf + offset, state) != 0) {
+        FT_ATOMIC_STORE_SSIZE(soself->mutex_cnt, prev_cnt);
         PyBuffer_Release(&buffer);
         return NULL;
     }
+    FT_ATOMIC_STORE_SSIZE(soself->mutex_cnt, prev_cnt);
 
     PyBuffer_Release(&buffer);
     Py_RETURN_NONE;