gh-60107: avoid `io.RawIOBase.read` from reading into a temporary bytearray by taskevich · Pull Request #138616 · python/cpython

Maybe I wasn't precise enough. RawIOBase.read() is implemented in terms of readinto. So, what we want to do is provide a readinto method that does something bad as it's given the internal buffer we constructed in C. I don't know if it's possible to cause a segfault on main with that approach though.

Stated otherwise, we want some class:

class EvilReadInto(MockRawIOWithoutRead):
    def readinto(self, buf):
        # do something bad with 'buf'

And then

r = EvilReadInto(something_here)
r.read()  # on main, this call should crash, but not with this patch