bpo-39382: Avoid dangling object use in abstract_issubclass() (GH-18530)

Hold reference of __bases__ tuple until tuple item is done with, because by
dropping the reference the item may be destroyed.

1 files changed, 9 insertions, 3 deletions

diff --git a/Objects/abstract.c b/Objects/abstract.c
index f0e01f7691..de5652f3e6 100644
--- a/Objects/abstract.c
+++ b/Objects/abstract.c
@@ -2379,9 +2379,16 @@ abstract_issubclass(PyObject *derived, PyObject *cls)
     int r = 0;
 
     while (1) {
-        if (derived == cls)
+        if (derived == cls) {
+            Py_XDECREF(bases); /* See below comment */
             return 1;
-        bases = abstract_get_bases(derived);
+        }
+        /* Use XSETREF to drop bases reference *after* finishing with
+           derived; bases might be the only reference to it.
+           XSETREF is used instead of SETREF, because bases is NULL on the
+           first iteration of the loop.
+        */
+        Py_XSETREF(bases, abstract_get_bases(derived));
         if (bases == NULL) {
             if (PyErr_Occurred())
                 return -1;
@@ -2395,7 +2402,6 @@ abstract_issubclass(PyObject *derived, PyObject *cls)
         /* Avoid recursivity in the single inheritance case */
         if (n == 1) {
             derived = PyTuple_GET_ITEM(bases, 0);
-            Py_DECREF(bases);
             continue;
         }
         for (i = 0; i < n; i++) {