gh-142734: fix UAF in OrderedDict.copy with concurrent mutations by __getitem__

Lib/test/test_ordered_dict.py

@@ -10,6 +10,7 @@
 import sys
 import unittest
 import weakref
+
 from collections.abc import MutableMapping
 from test import mapping_tests, support
 from test.support import import_helper
@@ -970,6 +971,77 @@ def test_weakref_list_is_not_traversed(self):
 
         gc.collect()
 
+    def test_getitem_re_entrant_clear_during_copy(self):
+        class Evil(self.OrderedDict):
+            def __getitem__(self, key):
+                super().clear()
+                return None
+
+        evil_dict = Evil([(i, i) for i in range(4)])
+        with self.assertRaises(RuntimeError):
+            result = evil_dict.copy()
+
+    def test_getitem_re_entrant_modify_during_copy(self):
+        class Modifier(self.OrderedDict):
+            def __getitem__(self, key):
+                self['new_key'] = 'new_value'
+                return super().__getitem__(key)
+
+        original = Modifier([(1, 'one'), (2, 'two')])
+        with self.assertRaises(RuntimeError):
+            result = original.copy()
+
+    def test_getitem_re_entrant_delete_during_copy(self):
+        class Deleter(self.OrderedDict):
+            call_count = 0
+            def __getitem__(self, key):
+                Deleter.call_count += 1
+                if Deleter.call_count == 1:
+                    del self[3]
+                return super().__getitem__(key)
+
+        original = Deleter([(1, 'one'), (2, 'two'), (3, 'three')])
+        with self.assertRaises(RuntimeError):
+            result = original.copy()
+
+    def test_getitem_re_entrant_add_during_copy(self):
+        class MultiAdder(self.OrderedDict):
+            def __getitem__(self, key):
+                self['new_key1'] = 'new_value1'
+                return super().__getitem__(key)
+
+        original = MultiAdder([(1, 'one'), (2, 'two'), (3, 'three')])
+        with self.assertRaises(RuntimeError):
+            result = original.copy()
+
+    def test_getitem_re_entrant_pop_during_copy(self):
+        class Popper(self.OrderedDict):
+            call_count = 0
+            def __getitem__(self, key):
+                Popper.call_count += 1
+                if Popper.call_count == 1:
+                    self.pop(3, None)
+                return super().__getitem__(key)
+
+        original = Popper([(1, 'one'), (2, 'two'), (3, 'three')])
+        with self.assertRaises(RuntimeError):
+            result = original.copy()
+
+    def test_getitem_re_entrant_mixed_mutation_during_copy(self):
+        class MixedMutator(self.OrderedDict):
+            call_count = 0
+            def __getitem__(self, key):
+                MixedMutator.call_count += 1
+                if MixedMutator.call_count == 1:
+                    del self[3]
+                elif MixedMutator.call_count == 2:
+                    self['new_key'] = 'new_value'
+                return super().__getitem__(key)
+
+        original = MixedMutator([(1, 'one'), (2, 'two'), (3, 'three'), (4, 'four')])
+        with self.assertRaises(RuntimeError):
+            result = original.copy()
+
 
 class PurePythonOrderedDictSubclassTests(PurePythonOrderedDictTests):
 

Misc/NEWS.d/next/Library/2025-12-22-15-02-16.gh-issue-142734.IxVAQh.rst

@@ -0,0 +1 @@
+fix ordereddict copy heap-use-after-free security issue

Objects/odictobject.c

@@ -1266,17 +1266,35 @@ OrderedDict_copy_impl(PyObject *od)
         }
     }
     else {
-        _odict_FOREACH(od, node) {
-            int res;
-            PyObject *value = PyObject_GetItem((PyObject *)od,
-                                               _odictnode_KEY(node));
-            if (value == NULL)
+        PyODictObject *self = _PyODictObject_CAST(od);
+        size_t state = self->od_state;
+        _ODictNode *cur;
+
+        _odict_FOREACH(od, cur) {
+            if (self->od_state != state) {
+                PyErr_SetString(PyExc_RuntimeError,
+                                "OrderedDict mutated during iteration");
                 goto fail;
-            res = PyObject_SetItem((PyObject *)od_copy,
-                                   _odictnode_KEY(node), value);
+            }
+            PyObject *key = Py_NewRef(_odictnode_KEY(cur));
+            PyObject *value = PyObject_GetItem(od, key);
+            if (value == NULL) {
+                Py_DECREF(key);
+                goto fail;
+            }
+            if (self->od_state != state) {
+                Py_DECREF(key);
+                Py_DECREF(value);
+                PyErr_SetString(PyExc_RuntimeError,
+                                "OrderedDict mutated during iteration");
+                goto fail;
+            }
+            int rc = PyObject_SetItem(od_copy, key, value);
+            Py_DECREF(key);
             Py_DECREF(value);
-            if (res != 0)
+            if (rc != 0) {
                 goto fail;
+            }
         }
     }
     return od_copy;