gh-142734: fix UAF in OrderedDict.copy with concurrent mutations by __getitem__

Lib/test/test_ordered_dict.py

@@ -10,6 +10,7 @@
 import sys
 import unittest
 import weakref
+
 from collections.abc import MutableMapping
 from test import mapping_tests, support
 from test.support import import_helper
@@ -873,6 +874,26 @@ def side_effect(self):
         self.assertDictEqual(dict1, dict.fromkeys((0, 4.2)))
         self.assertDictEqual(dict2, dict.fromkeys((0, Key(), 4.2)))
 
+    def test_getitem_re_entrant_clear_during_copy(self):
+        class Evil(self.OrderedDict):
+            def __getitem__(self, key):
+                super().clear()
+                return None
+
+        evil_dict = Evil([(i, i) for i in range(4)])
+        with self.assertRaises(RuntimeError):
+            result = evil_dict.copy()
+
+    def test_getitem_re_entrant_modify_during_copy(self):
+        class Modifier(self.OrderedDict):
+            def __getitem__(self, key):
+                self['new_key'] = 'new_value'
+                return super().__getitem__(key)
+
+        original = Modifier([(1, 'one'), (2, 'two')])
+        with self.assertRaises(RuntimeError):
+            result = original.copy()
+
 
 @unittest.skipUnless(c_coll, 'requires the C version of the collections module')
 class CPythonOrderedDictTests(OrderedDictTests,

Misc/NEWS.d/next/Library/2025-12-22-15-02-16.gh-issue-142734.IxVAQh.rst

@@ -0,0 +1 @@
+fix ordereddict copy heap-use-after-free security issue

Objects/odictobject.c

@@ -1266,17 +1266,38 @@ OrderedDict_copy_impl(PyObject *od)
         }
     }
     else {
-        _odict_FOREACH(od, node) {
-            int res;
-            PyObject *value = PyObject_GetItem((PyObject *)od,
-                                               _odictnode_KEY(node));
-            if (value == NULL)
+        PyODictObject *self = _PyODictObject_CAST(od);
+        size_t state = self->od_state;
+        _ODictNode *cur = _odict_FIRST(od);
+
+        while (cur != NULL) {
+            if (self->od_state != state) {
+                PyErr_SetString(PyExc_RuntimeError,
+                                "OrderedDict mutated during iteration");
                 goto fail;
-            res = PyObject_SetItem((PyObject *)od_copy,
-                                   _odictnode_KEY(node), value);
-            Py_DECREF(value);
-            if (res != 0)
+            }
+            PyObject *key = Py_NewRef(_odictnode_KEY(cur));
+            PyObject *value = PyObject_GetItem((PyObject *)od, key);
+            if (value == NULL) {
+                Py_DECREF(key);
                 goto fail;
+            }
+            if (self->od_state != state) {
+                Py_DECREF(key);
+                Py_DECREF(value);
+                PyErr_SetString(PyExc_RuntimeError,
+                                "OrderedDict mutated during iteration");
+                goto fail;
+            }
+            if (PyObject_SetItem((PyObject *)od_copy, key, value) != 0) {
+                Py_DECREF(key);
+                Py_DECREF(value);
+                goto fail;
+            }
+            Py_DECREF(key);
+            Py_DECREF(value);
+
+            cur = _odictnode_NEXT(cur);
         }
     }
     return od_copy;