fix: eliminate race condition in list rich comparison

Author: KowalskiThomas

Objects/listobject.c

@@ -3432,44 +3432,58 @@ list_richcompare_impl(PyObject *v, PyObject *w, int op)
             Py_RETURN_TRUE;
     }
 
-    /* Search for the first index where items are different */
+    /* Search for the first index where items are different.
+     * Keep vitem/witem alive across the break so that the final ordering
+     * comparison uses the same differing objects.
+     * This is required as PyObject_RichCompareBool may release the GIL and
+     * the list may be mutated in the meantime.
+     */
+    PyObject *vitem = NULL;
+    PyObject *witem = NULL;
     for (i = 0; i < Py_SIZE(vl) && i < Py_SIZE(wl); i++) {
-        PyObject *vitem = vl->ob_item[i];
-        PyObject *witem = wl->ob_item[i];
+        vitem = vl->ob_item[i];
+        witem = wl->ob_item[i];
         if (vitem == witem) {
             continue;
         }
 
         Py_INCREF(vitem);
         Py_INCREF(witem);
         int k = PyObject_RichCompareBool(vitem, witem, Py_EQ);
-        Py_DECREF(vitem);
-        Py_DECREF(witem);
-        if (k < 0)
+        if (k < 0) {
+            Py_DECREF(vitem);
+            Py_DECREF(witem);
             return NULL;
-        if (!k)
+        }
+        if (!k) {
+            /* keep vitem/witem alive for the final comparison */
             break;
+        }
+
+        Py_DECREF(vitem);
+        Py_DECREF(witem);
+        vitem = witem = NULL;
     }
 
-    if (i >= Py_SIZE(vl) || i >= Py_SIZE(wl)) {
-        /* No more items to compare -- compare sizes */
+    if (vitem == NULL) {
+        /* All compared elements were equal -- compare sizes */
         Py_RETURN_RICHCOMPARE(Py_SIZE(vl), Py_SIZE(wl), op);
     }
 
     /* We have an item that differs -- shortcuts for EQ/NE */
     if (op == Py_EQ) {
+        Py_DECREF(vitem);
+        Py_DECREF(witem);
         Py_RETURN_FALSE;
     }
     if (op == Py_NE) {
+        Py_DECREF(vitem);
+        Py_DECREF(witem);
         Py_RETURN_TRUE;
     }
 
-    /* Compare the final item again using the proper operator */
-    PyObject *vitem = vl->ob_item[i];
-    PyObject *witem = wl->ob_item[i];
-    Py_INCREF(vitem);
-    Py_INCREF(witem);
-    PyObject *result = PyObject_RichCompare(vl->ob_item[i], wl->ob_item[i], op);
+    /* Compare the differing items using the proper operator */
+    PyObject *result = PyObject_RichCompare(vitem, witem, op);
     Py_DECREF(vitem);
     Py_DECREF(witem);
     return result;