gh-159739: Recheck BytesIO state after converting truncate size (#160190)

A size object's __index__() can close a BytesIO or export its buffer after truncate() checks the stream. Continuing can dereference a cleared buffer or resize storage behind a live view. Recheck the stream state after size conversion. Backport to 3.15 and 3.14; on 3.14, put the regression test in Lib/test/test_memoryio.py.

Author: jelle-openai

Lib/test/test_io/test_memoryio.py

@@ -962,6 +962,28 @@ class CBytesIOTest(PyBytesIOTest):
     ioclass = io.BytesIO
     UnsupportedOperation = io.UnsupportedOperation
 
+    def test_truncate_size_changes_stream(self):
+        class Size:
+            def __init__(self, action):
+                self.action = action
+
+            def __index__(self):
+                self.result = self.action()
+                return 0
+
+        stream = self.ioclass(b'abc')
+        with self.assertRaises(ValueError):
+            stream.truncate(Size(stream.close))
+
+        with self.ioclass(b'abc') as stream:
+            size = Size(stream.getbuffer)
+            try:
+                with self.assertRaises(BufferError):
+                    stream.truncate(size)
+                self.assertEqual(stream.getvalue(), b'abc')
+            finally:
+                size.result.release()
+
     def test_readinto_overlapping_buffer(self):
         with self.ioclass(b'abcd') as stream:
             with stream.getbuffer()[1:] as target:

Misc/NEWS.d/next/Library/2026-10-21-21-26-10.gh-issue-159739.rVWF2a.rst

@@ -0,0 +1 @@
+Fix the ``truncate`` method on :class:`io.BytesIO` when converting its size argument closes the stream or exports its buffer.

Modules/_io/bytesio.c

@@ -754,6 +754,8 @@ _io_BytesIO_truncate_impl(bytesio *self, PyObject *size)
                          "negative size value %zd", new_size);
             return NULL;
         }
+        CHECK_CLOSED(self);
+        CHECK_EXPORTS(self);
     }
 
     if (new_size < self->string_size) {