python · tomasr8 · Jan 7, 2026 · Jan 8, 2026 · Jan 8, 2026 · Jan 8, 2026
diff --git a/Lib/test/test_io/test_bufferedio.py b/Lib/test/test_io/test_bufferedio.py
@@ -983,6 +983,17 @@ def closed(self):
         self.assertRaisesRegex(ValueError, "test", bufio.flush)
         self.assertRaisesRegex(ValueError, "test", bufio.close)
 
+    def test_gh_143375(self):
+        bufio = self.tp(self.MockRawIO())
+
+        class EvilIndex:
+            def __index__(self):
+                bufio.close()
+                return 0
+
+        with self.assertRaisesRegex(ValueError, "seek of closed file"):
+            bufio.seek(EvilIndex())
+
 
 class PyBufferedWriterTest(BufferedWriterTest, PyTestCase):
     tp = pyio.BufferedWriter

diff --git a/Misc/NEWS.d/next/Library/2026-01-08-19-56-40.gh-issue-143375.QCzA_8.rst b/Misc/NEWS.d/next/Library/2026-01-08-19-56-40.gh-issue-143375.QCzA_8.rst
@@ -0,0 +1,2 @@
+Fix a crash in the ``seek`` method of :class:`~io.BufferedWriter` when
+passing an object with a specially crafted :meth:`~object.__index__`.
diff --git a/Modules/_io/bufferedio.c b/Modules/_io/bufferedio.c
@@ -1393,6 +1393,10 @@ _io__Buffered_seek_impl(buffered *self, PyObject *targetobj, int whence)
     if (target == -1 && PyErr_Occurred())
         return NULL;
 
+    // PyNumber_AsOff_t calls user code via __index__, which
+    // could have closed the file.
+    CHECK_CLOSED(self, "seek of closed file")
+
     /* SEEK_SET and SEEK_CUR are special because we could seek inside the
        buffer. Other whence values must be managed without this optimization.
        Some Operating Systems can provide additional values, like
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		Fix a crash in the ``seek`` method of :class:`~io.BufferedWriter` when
Copy link Copy Markdown Member serhiy-storchaka Jan 9, 2026 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Is it only BufferedWriter or other buffered streams? Copy link Copy Markdown Member Author tomasr8 Apr 5, 2026 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. It's also BufferedReader and BufferedRandom since they share the same implementation. I updated the news entry and added tests!
		passing an object with a specially crafted :meth:`~object.__index__`.
Copy link Copy Markdown Member serhiy-storchaka Jan 9, 2026 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. No, a specially crafted `__index__()` is not a cause, it is only a mean of reproducing the issue. The root issue is that the buffered stream can be closed (or detached?) concurrently with `seek()`. This can happen in other thread (or in the garbage collector), when the GIL is released in not so special custom `__index__()`. Copy link Copy Markdown Member Author tomasr8 Apr 5, 2026 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. True, I updated the news entry with the root cause. Let me know if it's ok!