gh-153296: Fix thread-safety data race in io.StringIO iterator (#153368)

https://github.com/python/cpython/commit/bff005123119d5a010774f5dc9a181029024c2ac
commit: bff005123119d5a010774f5dc9a181029024c2ac
branch: main
author: Rishit Agnihotri <[email protected]>
committer: kumaraditya303 <[email protected]>
date: 2026-07-25T14:05:25+05:30
summary:

gh-153296: Fix thread-safety data race in io.StringIO iterator (#153368)

files:
A Misc/NEWS.d/next/Library/2026-07-08-15-26-00.gh-issue-153296.Twix12.rst
M Modules/_io/stringio.c

diff --git a/Misc/NEWS.d/next/Library/2026-07-08-15-26-00.gh-issue-153296.Twix12.rst b/Misc/NEWS.d/next/Library/2026-07-08-15-26-00.gh-issue-153296.Twix12.rst
new file mode 100644
index 000000000000000..22604dd31dd6050
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-07-08-15-26-00.gh-issue-153296.Twix12.rst
@@ -0,0 +1 @@
+Fix a data race and use-after-free when iterating over an :class:`io.StringIO` object while it is being concurrently mutated. The ``__next__`` method now properly acquires the object's lock.
diff --git a/Modules/_io/stringio.c b/Modules/_io/stringio.c
index b8601383ad0a26f..27605b4c44239e9 100644
--- a/Modules/_io/stringio.c
+++ b/Modules/_io/stringio.c
@@ -407,8 +407,10 @@ _io_StringIO_readline_impl(stringio *self, Py_ssize_t size)
 }
 
 static PyObject *
-stringio_iternext(PyObject *op)
+stringio_iternext_lock_held(PyObject *op)
 {
+    _Py_CRITICAL_SECTION_ASSERT_OBJECT_LOCKED(op);
+
     PyObject *line;
     stringio *self = stringio_CAST(op);
 
@@ -444,6 +446,16 @@ stringio_iternext(PyObject *op)
     return line;
 }
 
+static PyObject *
+stringio_iternext(PyObject *op)
+{
+    PyObject *ret;
+    Py_BEGIN_CRITICAL_SECTION(op);
+    ret = stringio_iternext_lock_held(op);
+    Py_END_CRITICAL_SECTION();
+    return ret;
+}
+
 /*[clinic input]
 @critical_section
 _io.StringIO.truncate

_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]