Possible memory leak in gc_mark_span_push

[sergey-miryanov]

Bug report

Bug description:

gc_mark_span_push uses PyMem_Realloc to reallocate the memory buffer and uses it as follows:

cpython/Python/gc_free_threading.c

Lines 678 to 681 in d13ee0a

	ss->stack = (gc_span_t *)PyMem_Realloc(ss->stack, ss->capacity * sizeof(gc_span_t));
	if (ss->stack == NULL) {
	return -1;
	}

There are two is one problem:
1. Undefined behavior - The original pointer ptr is invalidated and any access to it is undefined behavior (even if reallocation was in-place).
2. Memory leak if PyMem_Realloc fails - the original buffer will not be freed, but ss->stack pointer will be overwritten.

I have a PR ready.

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs

• GH-141212: Fix possible memory leak in gc_mark_span_push #141213

[colesbury]

Where is the undefined behavior?

[sergey-miryanov]

It seems that I was wrong about UB. Since we overwrite it, it should be OK here.
Thanks.