PyType_GetModuleByDef isn't safe to call in tp_dealloc #160840

// example.c

#define PY_SSIZE_T_CLEAN
#include <Python.h>
#include <stddef.h>

static PyModuleDef examplemodule = {
    PyModuleDef_HEAD_INIT,
    "example",
    "Example module with a heap type.",
    -1,
    NULL,
    NULL,
    NULL,
    NULL,
    NULL
};

typedef struct {
    PyObject_HEAD
    PyObject *first;
    PyObject *second;
} HeapPairObject;

static void
HeapPair_dealloc(HeapPairObject *self)
{
    PyTypeObject *tp = Py_TYPE(self);

    PyType_GetModuleByDef(tp, &examplemodule);

    PyObject_GC_UnTrack(self);
    Py_XDECREF(self->first);
    Py_XDECREF(self->second);

    tp->tp_free((PyObject *)self);

    Py_CLEAR(tp);
}

static void
HeapPair_clear(HeapPairObject *self) {
    Py_CLEAR(self->first);
    Py_CLEAR(self->second);
}

static int
HeapPair_traverse(HeapPairObject *self, visitproc visit, void *arg) {
    Py_VISIT(self->first);
    Py_VISIT(self->second);
    Py_VISIT(Py_TYPE(self));

    return 0;
}

static PyObject *
HeapPair_new(PyTypeObject *subtype, PyObject *args, PyObject *kwds) {
    HeapPairObject *out = (HeapPairObject*)subtype->tp_alloc(subtype, 0);
    if (out) {
        // Create some exciting circular references
        out->first = Py_NewRef(subtype);
        out->second = Py_NewRef(out);
    }
    return (PyObject*)out;
}



static PyMemberDef HeapPair_members[] = {
    {"first", Py_T_OBJECT_EX, offsetof(HeapPairObject, first), 0, "first attribute"},
    {"second", Py_T_OBJECT_EX, offsetof(HeapPairObject, second), 0, "second attribute"},
    {NULL, 0, 0, 0, NULL}
};

static PyType_Slot HeapPair_slots[] = {
    {Py_tp_dealloc, HeapPair_dealloc},
    {Py_tp_members, HeapPair_members},
    {Py_tp_new, HeapPair_new},
    {Py_tp_clear, HeapPair_clear},
    {Py_tp_traverse, HeapPair_traverse},
    {0, NULL},
};

static PyType_Spec HeapPair_spec = {
    .name = "example.HeapPair",
    .basicsize = sizeof(HeapPairObject),
    .flags = Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HEAPTYPE | Py_TPFLAGS_BASETYPE | Py_TPFLAGS_HAVE_GC,
    .slots = HeapPair_slots,
};

PyMODINIT_FUNC
PyInit_example(void)
{
    PyObject *m;
    PyObject *type;

    m = PyModule_Create(&examplemodule);
    if (m == NULL) {
        return NULL;
    }

    type = PyType_FromSpec(&HeapPair_spec);
    if (type == NULL) {
        Py_DECREF(m);
        return NULL;
    }

    if (PyModule_AddObject(m, "HeapPair", type) < 0) {
        Py_DECREF(type);
        Py_DECREF(m);
        return NULL;
    }

    return m;
}