itertools.zip_longest use-after-free via re-entrant iterator exhaust #154672

import itertools, gc

zl_ref = [None]

class CustomIter:
    def __init__(self, data):
        self.data = data
        self.idx = 0
    def __iter__(self):
        return self
    def __next__(self):
        if self.idx >= len(self.data):
            raise StopIteration
        val = self.data[self.idx]
        self.idx += 1
        return val

class Evil:
    armed = True
    def __bool__(self):
        if Evil.armed and zl_ref[0] is not None:
            Evil.armed = False
            try:
                while True:          # re-enter and drain the filter iterator
                    next(zl_ref[0])
            except StopIteration:
                pass
        return False

f = filter(None, CustomIter([Evil() for _ in range(3)]))
zl = itertools.zip_longest(f, range(5), fillvalue=-1)
zl_ref[0] = zl
del f                                # ittuple now owns the only ref to the filter
gc.collect()
print(next(zl))