PublicArchive/cpython
2
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2026-07-08 03:00:00 -04:00
Code Issues Packages Projects Releases Wiki Activity

[3.15] gh-152682: Fix NULL dereference on OOM in symtable_visit_type_param_bound_or_default (GH-152684) (#152695)

Browse Source 
In `symtable_visit_type_param_bound_or_default()`, when a reserved name
(e.g. `__classdict__`) is used as a type parameter, `PyUnicode_FromFormat()`
is called to build the SyntaxError message. If the allocation fails and
returns NULL, the subsequent `PyErr_SetObject()` and `Py_DECREF()` calls
would dereference NULL, causing a segfault.

Fix by returning 0 immediately when `PyUnicode_FromFormat()` returns NULL.
This propagates the MemoryError set by `PyUnicode_FromFormat()`.

The bug was introduced in gh-128632 (commit 891c61c).
(cherry picked from commit 10ed03edf1)

Co-authored-by: Petr Vaganov <petrvaganoff@gmail.com>

* Remove test

---------

Co-authored-by: Petr Vaganov <petrvaganoff@gmail.com>
Co-authored-by: Stan Ulbrych <stan@python.org>
This commit is contained in:
Miss Islington (bot)
2026-07-06 18:36:32 +02:00
committed by GitHub
parent fdba15ada0
commit ffb5184dfb
2 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Misc/NEWS.d/next/Core_and_Builtins/2026-06-30-14-00-00.gh-issue-152682.yId7e5.rst
+3
View File
@@ -0,0 +1,3 @@
Fix NULL pointer dereference in :func:`compile` when a reserved name (e.g.
``__classdict__``) is used as a type parameter name and memory allocation
fails while formatting the error message.
Python/symtable.c
+3
View File
@@ -2678,6 +2678,9 @@ symtable_visit_type_param_bound_or_default(
PyObject *error_msg = PyUnicode_FromFormat("reserved name '%U' cannot be "
"used for type parameter", name);
if (error_msg == NULL) {
return 0;
}
PyErr_SetObject(PyExc_SyntaxError, error_msg);
Py_DECREF(error_msg);
SET_ERROR_LOCATION(st->st_filename, LOCATION(tp));