[issue12340] Access violation when using the C version of the io module

[Santoso Wijaya]

Santoso Wijaya <santoso.wijaya at gmail.com> added the comment:

Regarding the crash,

>From what I can see, the `tp_clear` method of bufferedrwpair is called during Py_Finalize() that leads to garbage collection. This NULLs `self->writer` for the rwpair object.

Later, in the same garbage collection routine, the `tp_clear` of textio (the wrapper) is called. This attempts to finalize its wrapped object by first calling the `closed` property of the wrapped object. This property read is propagated down to the wrapped bufferedrwpair, `bufferedrwpair_closed_get()`.

At this point, `self->writer` for the bufferedrwpair object is already NULL from the previous clear. Hence, the crash happens because a NULL pointer dereferencing is attempted.

----------
nosy: +santa4nt

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue12340>
_______________________________________