lul-cas · Sep 24, 2026 · Sep 24, 2026
diff --git a/Lib/test/test_iter.py b/Lib/test/test_iter.py
@@ -532,6 +532,28 @@ def spam():
         with self.assertRaises(StopIteration):
             next(spam.iterator)
 
+    def test_calliter_reentrant_sentinel_compare(self):
+        destroyed = []
+        compared = []
+
+        class Sentinel:
+            def __del__(self):
+                destroyed.append(True)
+
+            def __eq__(self, other):
+                it.__setstate__(((), StopIteration))
+                return NotImplemented
+
+        class Result:
+            def __eq__(self, other):
+                compared.append(isinstance(other, Sentinel) and not destroyed)
+                return NotImplemented
+
+        it = iter(lambda: Result(), Sentinel())
+        value = next(it)
+        self.assertIsInstance(value, Result)
+        self.assertEqual(compared, [True])
+
     # Test exception propagation through function iterator
     def test_exception_function(self):
         def spam(state=[0]):

diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-23-21-41-00.gh-issue-158031.nW4pQs.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-09-23-21-41-00.gh-issue-158031.nW4pQs.rst
@@ -0,0 +1,3 @@
+Fix a use-after-free in the two-argument form of :func:`iter` when comparing
+the sentinel. A reentrant equality comparison could clear the sentinel and
+free it while the comparison was still using it.
diff --git a/Objects/iterobject.c b/Objects/iterobject.c
@@ -282,7 +282,9 @@ calliter_iternext(PyObject *op)
         if (it->it_sentinel == NULL) {
             return result; /* Common case, fast path */
         }
-        int ok = PyObject_RichCompareBool(it->it_sentinel, result, Py_EQ);
+        PyObject *sentinel = Py_NewRef(it->it_sentinel);
+        int ok = PyObject_RichCompareBool(sentinel, result, Py_EQ);
+        Py_DECREF(sentinel);
         if (ok == 0) {
             return result; /* Common case, fast path */
         }