UAF in GC visit_generation() #160663

#include <Python.h>

static PyObject *victim;            /* the only reference to the victim */

static int
drop_current(PyObject *op, void *arg)
{
    if (op == victim) {
        Py_CLEAR(victim);           /* the visitor's +1 is now the last ref */
    }
    return 1;
}

static PyObject *
run(PyObject *module, PyObject *unused)
{
    victim = PySet_New(NULL);       /* GC-tracked, and sets have no freelist */
    if (victim == NULL) {
        return NULL;
    }
    PyUnstable_GC_VisitObjects(drop_current, NULL);     /* segfaults */
    Py_RETURN_NONE;
}

static PyMethodDef methods[] = {
    {"run", run, METH_NOARGS, NULL},
    {NULL, NULL, 0, NULL},
};

static struct PyModuleDef module = {
    PyModuleDef_HEAD_INIT, "visitmin", NULL, -1, methods,
};

PyMODINIT_FUNC
PyInit_visitmin(void)
{
    return PyModule_Create(&module);
}

import visitmin
visitmin.run()
print("no crash")