From 871b620780b52d5ffc96e8640ad16d5e44747e2d Mon Sep 17 00:00:00 2001
From: Kumar Aditya <kumaraditya@python.org>
Date: Tue, 12 Nov 2024 17:31:48 +0530
Subject: [PATCH] fix use-after-free

---
 Modules/_asynciomodule.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Modules/_asynciomodule.c b/Modules/_asynciomodule.c
index 617a3dca35d9c2..f883125a2c70b2 100644
--- a/Modules/_asynciomodule.c
+++ b/Modules/_asynciomodule.c
@@ -1017,8 +1017,10 @@ _asyncio_Future_remove_done_callback_impl(FutureObj *self, PyTypeObject *cls,
 
     if (len == 1) {
         PyObject *cb_tup = PyList_GET_ITEM(self->fut_callbacks, 0);
+        Py_INCREF(cb_tup);
         int cmp = PyObject_RichCompareBool(
             PyTuple_GET_ITEM(cb_tup, 0), fn, Py_EQ);
+        Py_DECREF(cb_tup);
         if (cmp == -1) {
             return NULL;
         }