From 45c0b388809d561750c4f0c791de6ec571215d26 Mon Sep 17 00:00:00 2001
From: "Miss Islington (bot)"
 <31488909+miss-islington@users.noreply.github.com>
Date: Wed, 25 Oct 2023 13:25:31 +0200
Subject: [PATCH] [3.12] gh-111174: Fix crash in getbuffer() called repeatedly
 for empty BytesIO (GH-111210) (GH-111314)

(cherry picked from commit 9da98c0d9a7cc55c67fb0bd3fa162fd3b2c2629b)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
---
 Lib/test/test_memoryio.py                          | 14 ++++++++++++++
 .../2023-10-23-13-53-58.gh-issue-111174.Oohmzd.rst |  2 ++
 Modules/_io/bytesio.c                              |  7 ++++---
 3 files changed, 20 insertions(+), 3 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Library/2023-10-23-13-53-58.gh-issue-111174.Oohmzd.rst

diff --git a/Lib/test/test_memoryio.py b/Lib/test/test_memoryio.py
index cd2faba1791c77..731299294e6877 100644
--- a/Lib/test/test_memoryio.py
+++ b/Lib/test/test_memoryio.py
@@ -463,6 +463,20 @@ def test_getbuffer(self):
         memio.close()
         self.assertRaises(ValueError, memio.getbuffer)
 
+    def test_getbuffer_empty(self):
+        memio = self.ioclass()
+        buf = memio.getbuffer()
+        self.assertEqual(bytes(buf), b"")
+        # Trying to change the size of the BytesIO while a buffer is exported
+        # raises a BufferError.
+        self.assertRaises(BufferError, memio.write, b'x')
+        buf2 = memio.getbuffer()
+        self.assertRaises(BufferError, memio.write, b'x')
+        buf.release()
+        self.assertRaises(BufferError, memio.write, b'x')
+        buf2.release()
+        memio.write(b'x')
+
     def test_read1(self):
         buf = self.buftype("1234567890")
         self.assertEqual(self.ioclass(buf).read1(), buf)
diff --git a/Misc/NEWS.d/next/Library/2023-10-23-13-53-58.gh-issue-111174.Oohmzd.rst b/Misc/NEWS.d/next/Library/2023-10-23-13-53-58.gh-issue-111174.Oohmzd.rst
new file mode 100644
index 00000000000000..95c315404d0ee6
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2023-10-23-13-53-58.gh-issue-111174.Oohmzd.rst
@@ -0,0 +1,2 @@
+Fix crash in :meth:`io.BytesIO.getbuffer` called repeatedly for empty
+BytesIO.
diff --git a/Modules/_io/bytesio.c b/Modules/_io/bytesio.c
index 80773058693259..7636394c35a459 100644
--- a/Modules/_io/bytesio.c
+++ b/Modules/_io/bytesio.c
@@ -124,12 +124,13 @@ unshare_buffer(bytesio *self, size_t size)
 static int
 resize_buffer(bytesio *self, size_t size)
 {
+    assert(self->buf != NULL);
+    assert(self->exports == 0);
+
     /* Here, unsigned types are used to avoid dealing with signed integer
        overflow, which is undefined in C. */
     size_t alloc = PyBytes_GET_SIZE(self->buf);
 
-    assert(self->buf != NULL);
-
     /* For simplicity, stay in the range of the signed type. Anyway, Python
        doesn't allow strings to be longer than this. */
     if (size > PY_SSIZE_T_MAX)
@@ -1072,7 +1073,7 @@ bytesiobuf_getbuffer(bytesiobuf *obj, Py_buffer *view, int flags)
             "bytesiobuf_getbuffer: view==NULL argument is obsolete");
         return -1;
     }
-    if (SHARED_BUF(b)) {
+    if (b->exports == 0 && SHARED_BUF(b)) {
         if (unshare_buffer(b, b->string_size) < 0)
             return -1;
     }