bpo-27946: Fix possible crash in ElementTree.Element (GH-29915)

Getting an attribute via attrib.get() simultaneously with replacing the attrib dict can lead to access to deallocated dict. (cherry picked from commit d15cdb2) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

Author: miss-islington

Lib/test/test_xml_etree_c.py

@@ -169,6 +169,18 @@ def test_xmlpullparser_leaks(self):
  del parser
  support.gc_collect()
 
+ def test_dict_disappearing_during_get_item(self):
+ # test fix for seg fault reported in issue 27946
+ class X:
+ def __hash__(self):
+ e.attrib = {} # this frees e->extra->attrib
+ [{i: i} for i in range(1000)] # exhaust the dict keys cache
+ return 13
+
+ e = cET.Element("elem", {1: 2})
+ r = e.get(X())
+ self.assertIsNone(r)
+
 
 @unittest.skipUnless(cET, 'requires _elementtree')
 class TestAliasWorking(unittest.TestCase):

Misc/NEWS.d/next/Library/2021-12-04-20-08-42.bpo-27946.-Vuarf.rst

@@ -0,0 +1,3 @@
+Fix possible crash when getting an attribute of
+class:`xml.etree.ElementTree.Element` simultaneously with
+replacing the ``attrib`` dict.

Modules/_elementtree.c

@@ -1393,22 +1393,19 @@ _elementtree_Element_get_impl(ElementObject *self, PyObject *key,
  PyObject *default_value)
 /*[clinic end generated code: output=523c614142595d75 input=ee153bbf8cdb246e]*/
 {
- PyObject* value;
-
- if (!self->extra || !self->extra->attrib)
- value = default_value;
- else {
- value = PyDict_GetItemWithError(self->extra->attrib, key);
- if (!value) {
- if (PyErr_Occurred()) {
- return NULL;
- }
- value = default_value;
+ if (self->extra && self->extra->attrib) {
+ PyObject *attrib = self->extra->attrib;
+ Py_INCREF(attrib);
+ PyObject *value = PyDict_GetItemWithError(attrib, key);
+ Py_XINCREF(value);
+ Py_DECREF(attrib);
+ if (value != NULL || PyErr_Occurred()) {
+ return value;
  }
  }
 
- Py_INCREF(value);
- return value;
+ Py_INCREF(default_value);
+ return default_value;
 }
 
 static PyObject *