gh-142734: fix UAF in OrderedDict.copy with concurrent mutations by __getitem__

Lib/test/test_ordered_dict.py

@@ -10,6 +10,7 @@
 import sys
 import unittest
 import weakref
+
 from collections.abc import MutableMapping
 from test import mapping_tests, support
 from test.support import import_helper
@@ -970,6 +971,75 @@ def test_weakref_list_is_not_traversed(self):
 
         gc.collect()
 
+    def test_copy_concurrent_clear_in__getitem__(self):
+        class MyOD(self.OrderedDict):
+            def __getitem__(self, key):
+                super().clear()
+                return None
+
+        od = MyOD([(i, i) for i in range(4)])
+        self.assertRaises(RuntimeError, od.copy)
+
+    def test_copy_concurrent_insertion_in__getitem__(self):
+        class MyOD(self.OrderedDict):
+            def __getitem__(self, key):
+                self['new_key'] = 'new_value'
+                return super().__getitem__(key)
+
+        od = MyOD([(1, 'one'), (2, 'two')])
+        self.assertRaises(RuntimeError, od.copy)
+
+    def test_copy_concurrent_deletion_by_del_in__getitem__(self):
+        class MyOD(self.OrderedDict):
+            call_count = 0
+            def __getitem__(self, key):
+                self.call_count += 1
+                if self.call_count == 1:
+                    del self[3]
+                return super().__getitem__(key)
+
+        od = MyOD([(1, 'one'), (2, 'two'), (3, 'three')])
+        self.assertRaises(RuntimeError, od.copy)
+
+    def test_copy_concurrent_deletion_by_pop_in__getitem__(self):
+        class MyOD(self.OrderedDict):
+            call_count = 0
+            def __getitem__(self, key):
+                self.call_count += 1
+                if self.call_count == 1:
+                    self.pop(3)
+                return super().__getitem__(key)
+
+        od = MyOD([(1, 'one'), (2, 'two'), (3, 'three')])
+        self.assertRaises(RuntimeError, od.copy)
+
+    def test_copy_concurrent_deletion_and_set_in__getitem__(self):
+        class MyOD(self.OrderedDict):
+            call_count = 0
+            def __getitem__(self, key):
+                self.call_count += 1
+                if self.call_count == 1:
+                    del self[3]
+                elif self.call_count == 2:
+                    self['new_key'] = 'new_value'
+                return super().__getitem__(key)
+
+        od = MyOD([(1, 'one'), (2, 'two'), (3, 'three'), (4, 'four')])
+        self.assertRaises(RuntimeError, od.copy)
+
+    def test_copy_concurrent_mutation_in__setitem__(self):
+        od = None
+        class MyOD(self.OrderedDict):
+            call_count = 0
+            def __setitem__(self, key, value):
+                self.call_count += 1
+                if od is not None and len(od) > 1 and self.call_count == 1:
+                    del od[1]
+                return super().__setitem__(key, value)
+
+        od = MyOD([(1, 'one'), (2, 'two'), (3, 'three')])
+        self.assertRaises(RuntimeError, od.copy)
+
 
 class PurePythonOrderedDictSubclassTests(PurePythonOrderedDictTests):
 

Misc/NEWS.d/next/Library/2025-12-22-15-02-16.gh-issue-142734.IxVAQh.rst

@@ -0,0 +1 @@
+:mod:`collections`: fix use-after-free crashes in :meth:`OrderedDict.copy <dict.copy>` when the dictionary to copy is concurrently mutated.

Objects/odictobject.c

@@ -1266,21 +1266,36 @@ OrderedDict_copy_impl(PyObject *od)
         }
     }
     else {
+        PyODictObject *self = _PyODictObject_CAST(od);
+        size_t state = self->od_state;
+
         _odict_FOREACH(od, node) {
-            int res;
-            PyObject *value = PyObject_GetItem((PyObject *)od,
-                                               _odictnode_KEY(node));
-            if (value == NULL)
+            PyObject *key = Py_NewRef(_odictnode_KEY(node));
+            PyObject *value = PyObject_GetItem(od, key);
+            if (value == NULL) {
+                Py_DECREF(key);
+                if (self->od_state != state) {
+                    goto invalid_state;
+                }
                 goto fail;
-            res = PyObject_SetItem((PyObject *)od_copy,
-                                   _odictnode_KEY(node), value);
+            }
+
+            int rc = PyObject_SetItem(od_copy, key, value);
+            Py_DECREF(key);
             Py_DECREF(value);
-            if (res != 0)
+            if (rc != 0) {
                 goto fail;
+            }
+            if (self->od_state != state) {
+                goto invalid_state;
+            }
         }
     }
     return od_copy;
 
+invalid_state:
+    PyErr_SetString(PyExc_RuntimeError,
+                    "OrderedDict mutated during iteration");
 fail:
     Py_DECREF(od_copy);
     return NULL;