CPython 3.13: consolidated memory-safety and concurrency bugs #157196

Hello,

This issue consolidates 25 reproducible CPython 3.13 bugs involving memory safety and concurrency.

The bugs resulted from Python security research using static analysis. Each entry has a concrete PoC in the linked version-specific Gist. Although the collection is large, these bugs warrant inspection, especially the cases producing interpreter crashes, sanitizer failures, memory corruption, or similarly concrete failures.

This issue is associated with #157197 and #157198

Bugs

1. asyncio Future callback registry race — Concurrent callback registration or removal can retire an unlocked callback-list item before remove_done_callback() promotes it, producing an ASan crash.
2. Unlocked atexit callback array — Concurrent registry operations can use stale callback records and crash, while re-entrant comparison can delete an unrelated replacement callback.
3. BaseException.__setstate__() shared-dictionary race — Concurrent value replacement can reclaim a dictionary entry between PyDict_Next() and reference promotion.
4. Bytearray methods using unlocked shared storage — Concurrent storage replacement causes out-of-bounds reads and mixed-generation results across several bytearray operations.
5. bytes() conversion of a shared list — The exact-list conversion path can promote an item reclaimed by concurrent clear or resize, producing an ASan crash.
6. Shared CSV Reader state race — Concurrent next() calls can reallocate and corrupt the Reader's unlocked parser buffer and state.
7. Shared CSV Writer record-buffer race — Concurrent writerow() calls can overwrite one another and emit a row containing mixed input generations.
8. FrameLocalsProxy.__getitem__() extra-local race — Concurrent proxy assignment or deletion can reclaim a borrowed extra-local value before promotion.
9. Writable live-frame fast-local race — Proxy replacement can free a fast-local value while the evaluator or PyFrame_GetVar() is acquiring it, causing impossible object state and allocator corruption.
10. Function closure replacement during frame initialization — Concurrent closure replacement can release the tuple and cell while an unstarted frame initializes its free variables.
11. Unsynchronized whole-interpreter PyConfig access — Concurrent configuration setters and readers produce heap-use-after-free failures in wide-string-list copying and conversion.
12. Shared itertools combinator advancement — Concurrent next() calls corrupt mutable state in product, combinations, combinations_with_replacement, and permutations.
13. Shared itertools.tee cache race — Concurrent advancement can expose an uninitialized shared-cache slot to Py_NewRef, crashing both same-branch and sibling-branch modes.
14. Managed __dict__ replacement false miss — Attribute lookup can report AttributeError after inline storage is invalidated even though the replacement dictionary contains the attribute.
15. OrderedDict borrowed-value promotion race — Fixed-key replacement can reclaim values consumed by setdefault(), copy(), or values iteration and corrupt the allocator.
16. OrderedDict unlocked node state — Concurrent structural operations can invalidate the coupled base-dictionary table, fast-node array, and linked nodes during lookup.
17. partial.__repr__() keyword-dictionary race — Fixed-key replacement can reclaim a borrowed keyword value before formatting promotes it.
18. Exact-dictionary pickle batching race — Concurrent dictionary mutation can reclaim a borrowed entry before batch_dict_exact promotes it, producing an ASan crash.
19. Exact-list pickle batching race — Concurrent list replacement or resize can reclaim an item before batch_list_exact promotes it.
20. pickle.whichmodule() sys.modules race — Concurrent synthetic-module replacement can reclaim a borrowed module entry during the fallback scan and crash reference promotion.
21. _PyConfig_FromDict() nested-list race — Concurrent mutation of warnoptions can retire a raw list item before its type check and conversion.
22. globals["__builtins__"] replacement race — Evaluation can consume a borrowed builtins object after concurrent replacement frees it, causing stack or mutex corruption.
23. SQLite converter-registry race — Concurrent public-registry replacement can finalize a borrowed converter before the cursor row-cast map owns it.
24. str.maketrans() shared-dictionary race — Concurrent clear or replacement can retire borrowed keys and values, producing impossible translation tables or reclaimed objects.
25. warnings.filters list race — Direct list mutation can finalize a borrowed filter tuple before get_filter() inspects and promotes it, producing an ASan crash.