gh-143378: Fix use-after-free BytesIO write via re-entrant buffer access

PyObject_GetBuffer() can execute user code (e.g. via __buffer__), which may
close or otherwise mutate a BytesIO object while write() or writelines()
is in progress. This could invalidate the internal buffer and lead to a
use-after-free.

Temporarily bump the exports counter while acquiring the input buffer to
block re-entrant mutation, and add regression tests to ensure such cases
raise BufferError instead of crashing.

Author: superboy-zjc

Lib/test/test_io/test_memoryio.py

@@ -856,6 +856,37 @@ def test_cow_mutable(self):
         memio = self.ioclass(ba)
         self.assertEqual(sys.getrefcount(ba), old_rc)
 
+    @support.cpython_only
+    def test_uaf_buffer_write(self):
+        # Prevent use-after-free when write() triggers a re-entrant call that
+        # closes or mutates the BytesIO object.
+        # See: https://github.com/python/cpython/issues/143378
+        class TBuf:
+            def __init__(self, bio):
+                self.bio = bio
+            def __buffer__(self, flags):
+                self.bio.close()
+                return memoryview(b"A")
+
+        memio = self.ioclass()
+        self.assertRaises(BufferError, memio.write, TBuf(memio))
+
+    @support.cpython_only
+    def test_uaf_buffer_writelines(self):
+        # Prevent use-after-free when writelines() triggers a re-entrant call that
+        # closes or mutates the BytesIO object.
+        # See: https://github.com/python/cpython/issues/143378
+        class TBuf:
+            def __init__(self, bio):
+                self.bio = bio
+            def __buffer__(self, flags):
+                self.bio.close()
+                return memoryview(b"A")
+
+        memio = self.ioclass()
+        self.assertRaises(BufferError, memio.writelines, [TBuf(memio)])
+
+
 class CStringIOTest(PyStringIOTest):
     ioclass = io.StringIO
     UnsupportedOperation = io.UnsupportedOperation

Misc/NEWS.d/next/Library/2026-01-03-19-41-36.gh-issue-143378.29AvE7.rst

@@ -0,0 +1,2 @@
+Fix use-after-free crashes when a :class:`_io.BytesIO` object is mutated during
+buffer writes via :meth:`write` or :meth:`writelines`.

Modules/_io/bytesio.c

@@ -202,9 +202,14 @@ write_bytes_lock_held(bytesio *self, PyObject *b)
     }
 
     Py_buffer buf;
+    /* Issue #143378: Prevent re-entrant mutation during PyObject_GetBuffer() */
+    self->exports++;
     if (PyObject_GetBuffer(b, &buf, PyBUF_CONTIG_RO) < 0) {
+        self->exports--;
         return -1;
     }
+    self->exports--;
+
     Py_ssize_t len = buf.len;
     if (len == 0) {
         goto done;