gh-143637: Fix re-entrant mutation of ancillary data in socket.sendmsg()

Lib/test/test_socket.py

@@ -3572,6 +3572,33 @@ def _testSendmsgAfterClose(self):
 class SendmsgStreamTests(SendmsgTests):
     # Tests for sendmsg() which require a stream socket and do not
     # involve recvmsg() or recvmsg_into().
+    @unittest.skipUnless(hasattr(socket.socket, "sendmsg"),
+                     "sendmsg not supported")
+    def _test_sendmsg_reentrant_ancillary_mutation(self):
+        import socket
+
+        seq = []
+
+        class Mut:
+            def __init__(self):
+                self.tripped = False
+            def __index__(self):
+                if not self.tripped:
+                    self.tripped = True
+                    seq.clear()
+                return 0
+
+        seq[:] = [
+            (socket.SOL_SOCKET, Mut(), b'x'),
+            (socket.SOL_SOCKET, 0, b'x'),
+        ]
+
+        left, right = socket.socketpair()
+        self.addCleanup(left.close)
+        self.addCleanup(right.close)
+
+        with self.assertRaises(Exception):
+            left.sendmsg([b'x'], seq)
 
     def testSendmsgExplicitNoneAddr(self):
         # Check that peer address can be specified as None.

Modules/socketmodule.c

@@ -5001,24 +5001,28 @@ _socket_socket_sendmsg_impl(PySocketSockObject *s, PyObject *data_arg,
     controllen = controllen_last = 0;
     while (ncmsgbufs < ncmsgs) {
         size_t bufsize, space;
+        PyObject *item;
 
-        if (!PyArg_Parse(PySequence_Fast_GET_ITEM(cmsg_fast, ncmsgbufs),
-                         "(iiy*):[sendmsg() ancillary data items]",
-                         &cmsgs[ncmsgbufs].level,
-                         &cmsgs[ncmsgbufs].type,
-                         &cmsgs[ncmsgbufs].data))
+        item = PySequence_Fast_GET_ITEM(cmsg_fast, ncmsgbufs);
+        Py_INCREF(item);
+
+        if (!PyArg_Parse(item,
+                        "(iiy*):[sendmsg() ancillary data items]",
+                        &cmsgs[ncmsgbufs].level,
+                        &cmsgs[ncmsgbufs].type,
+                        &cmsgs[ncmsgbufs].data)){
+            Py_DECREF(item);
             goto finally;
+        }
+        Py_DECREF(item);
+
         bufsize = cmsgs[ncmsgbufs++].data.len;
 
-#ifdef CMSG_SPACE
-        if (!get_CMSG_SPACE(bufsize, &space)) {
-#else
-        if (!get_CMSG_LEN(bufsize, &space)) {
-#endif
+        if(!get_CMSG_SPACE(bufsize, &space)){
             PyErr_SetString(PyExc_OSError, "ancillary data item too large");
             goto finally;
         }
-        controllen += space;
+        controllen+=space;
         if (controllen > SOCKLEN_T_LIMIT || controllen < controllen_last) {
             PyErr_SetString(PyExc_OSError, "too much ancillary data");
             goto finally;