gh-143249: Fix buffer leak when overlapped operation fails to start (OS-Windows)

Lib/test/test_asyncio/test_windows_utils.py

@@ -129,5 +129,45 @@ def test_popen(self):
             pass
 
 
+class OverlappedLeakTests(unittest.TestCase):
+    def _invalid_socket_handle(self):
+        return 0
+
+    def test_overlapped_wsasendto_failure_releases_user_buffer(self):
+        ov = _overlapped.Overlapped()
+        buf = bytearray(4096)
+        with self.assertRaises(OSError):
+            ov.WSASendTo(self._invalid_socket_handle(),
+                         memoryview(buf), 0, ("127.0.0.1", 1))
+        # If the exported buffer is still held, this will raise BufferError.
+        buf.append(1)
+
+    def test_overlapped_wsarecvfrominto_failure_releases_user_buffer(self):
+        ov = _overlapped.Overlapped()
+        buf = bytearray(4096)
+        with self.assertRaises(OSError):
+            ov.WSARecvFromInto(self._invalid_socket_handle(),
+                               memoryview(buf), len(buf), 0)
+        # If the exported buffer is still held, this will raise BufferError.
+        buf.append(1)
+
+    @support.refcount_test
+    def test_overlapped_wsarecvfrom_failure_does_not_leak_allocated_buffer(self):
+        gettotalrefcount = support.get_attribute(sys, "gettotalrefcount")
+
+        def run_once():
+            ov = _overlapped.Overlapped()
+            with self.assertRaises(OSError):
+                ov.WSARecvFrom(self._invalid_socket_handle(), 4096, 0)
+
+        # Warm up
+        run_once()
+        before = gettotalrefcount()
+        for _ in range(2000):
+            run_once()
+        after = gettotalrefcount()
+        self.assertAlmostEqual(after - before, 0, delta=20)
+
+
 if __name__ == '__main__':
     unittest.main()

Misc/NEWS.d/next/Library/2025-12-28-14-41-02.gh-issue-143249.K4vEp4.rst

@@ -0,0 +1 @@
+Fix possible buffer leaks in Windows overlapped I/O operations when the operation fails.

Modules/overlapped.c

@@ -1806,7 +1806,7 @@ _overlapped_Overlapped_WSASendTo_impl(OverlappedObject *self, HANDLE handle,
         case ERROR_IO_PENDING:
             Py_RETURN_NONE;
         default:
-            self->type = TYPE_NOT_STARTED;
+            Overlapped_clear(self);
             return SetFromWindowsErr(err);
     }
 }
@@ -1873,7 +1873,7 @@ _overlapped_Overlapped_WSARecvFrom_impl(OverlappedObject *self,
     case ERROR_IO_PENDING:
         Py_RETURN_NONE;
     default:
-        self->type = TYPE_NOT_STARTED;
+        Overlapped_clear(self);
         return SetFromWindowsErr(err);
     }
 }
@@ -1940,7 +1940,7 @@ _overlapped_Overlapped_WSARecvFromInto_impl(OverlappedObject *self,
     case ERROR_IO_PENDING:
         Py_RETURN_NONE;
     default:
-        self->type = TYPE_NOT_STARTED;
+        Overlapped_clear(self);
         return SetFromWindowsErr(err);
     }
 }