Bug report

Bug description:

BytesIO.getvalue() (and read()/peek() covering the whole buffer) returns the internal bytes object without copying. Whether that object may later be modified in place is decided from its reference count alone, so if the caller hashed the result and dropped it, a same-size write(), a write through getbuffer(), or truncate() followed by a refilling write overwrites it in place and keeps the old cached hash.

import io
bio = io.BytesIO()
bio.write(b"abcd")
hash(bio.getvalue())
bio.seek(0)
bio.write(b"efgh")
v = bio.getvalue()
print(v == b"efgh", v in {b"efgh"})  # True False

The same happens when the hashed object was passed to BytesIO(data) and data was dropped. Set and dict lookups with the result silently miss. This dates back to the copy-on-write buffer added in 3.5 (gh-66202). gh-158219 was the same problem in bytearray.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-160181: Don't modify a hashed bytes buffer in place in io.BytesIO #160182
• [3.15] gh-160181: Don't modify a hashed bytes buffer in place in io.BytesIO (GH-160182) #160408
• [3.14] gh-160181: Don't modify a hashed bytes buffer in place in io.BytesIO (GH-160182) #160409