Fix crash in array.fromlist with reentrant __index__

Author: priyanshu2282-cyber

Lib/test/test_array.py

@@ -67,6 +67,25 @@ def test_empty(self):
         a += a
         self.assertEqual(len(a), 0)
 
+    def test_fromlist_reentrant_index_mutation(self):
+
+        class Evil:
+            def __init__(self, lst):
+                self.lst = lst
+            def __index__(self):
+                self.lst.clear()
+                return "not an int"
+
+        for typecode in ('I', 'L', 'Q'):
+            lst = []
+            e = Evil(lst)
+            lst.append(e)
+            del e
+            a = array.array(typecode)
+            with self.assertRaises(TypeError):
+                a.fromlist(lst)
+
+
 
 # Machine format codes.
 #

Modules/arraymodule.c

@@ -408,7 +408,10 @@ II_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
     int do_decref = 0; /* if nb_int was called */
 
     if (!PyLong_Check(v)) {
+        PyObject *orig_v = v;
+        Py_INCREF(orig_v);
         v = _PyNumber_Index(v);
+        Py_DECREF(orig_v);
         if (NULL == v) {
             return -1;
         }
@@ -468,7 +471,10 @@ LL_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
     int do_decref = 0; /* if nb_int was called */
 
     if (!PyLong_Check(v)) {
+        PyObject *orig_v = v;
+        Py_INCREF(orig_v);
         v = _PyNumber_Index(v);
+        Py_DECREF(orig_v);
         if (NULL == v) {
             return -1;
         }
@@ -521,7 +527,10 @@ QQ_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
     int do_decref = 0; /* if nb_int was called */
 
     if (!PyLong_Check(v)) {
+        PyObject *orig_v = v;
+        Py_INCREF(orig_v);
         v = _PyNumber_Index(v);
+        Py_DECREF(orig_v);
         if (NULL == v) {
             return -1;
         }