https://github.com/python/cpython/commit/a8edca62fc6d44d16c7f86d49421be1a5ebea3e5
commit: a8edca62fc6d44d16c7f86d49421be1a5ebea3e5
branch: main
author: Emma Smith <[email protected]>
committer: emmatyping <[email protected]>
date: 2025-10-21T14:48:29-07:00
summary:
gh-132835: Add defensive NULL checks to MRO resolution (GH-134763)
Currently, there are a few places where tp_mro could theoretically
become NULL, but do not in practice. This commit adds defensive checks for
NULL values to ensure that any changes do not introduce a crash and that
state invariants are upheld.
The assertions added in this commit are all instances where a NULL value would
get passed to something not expecting a NULL, so it is better to catch an
assertion failure than crash later on.
There are a few cases where it is OK for the return of lookup_tp_mro to be
NULL, such as when passed to is_subtype_with_mro, which handles this explicitly.
files:
M Objects/typeobject.c
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 721d48712446a0..6cc6d366a3598c 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -1780,7 +1780,7 @@ static int recurse_down_subclasses(PyTypeObject *type,
PyObject *name,
// Compute tp_mro for this type and all of its subclasses. This
// is called after __bases__ is assigned to an existing type.
static int
-mro_hierarchy(PyTypeObject *type, PyObject *temp)
+mro_hierarchy_for_complete_type(PyTypeObject *type, PyObject *temp)
{
ASSERT_TYPE_LOCK_HELD();
@@ -1791,6 +1791,7 @@ mro_hierarchy(PyTypeObject *type, PyObject *temp)
return res;
}
PyObject *new_mro = lookup_tp_mro(type);
+ assert(new_mro != NULL);
PyObject *tuple;
if (old_mro != NULL) {
@@ -1835,7 +1836,7 @@ mro_hierarchy(PyTypeObject *type, PyObject *temp)
Py_ssize_t n = PyList_GET_SIZE(subclasses);
for (Py_ssize_t i = 0; i < n; i++) {
PyTypeObject *subclass = _PyType_CAST(PyList_GET_ITEM(subclasses,
i));
- res = mro_hierarchy(subclass, temp);
+ res = mro_hierarchy_for_complete_type(subclass, temp);
if (res < 0) {
break;
}
@@ -1926,7 +1927,7 @@ type_set_bases_unlocked(PyTypeObject *type, PyObject
*new_bases, PyTypeObject *b
if (temp == NULL) {
goto bail;
}
- if (mro_hierarchy(type, temp) < 0) {
+ if (mro_hierarchy_for_complete_type(type, temp) < 0) {
goto undo;
}
Py_DECREF(temp);
@@ -3432,6 +3433,7 @@ mro_implementation_unlocked(PyTypeObject *type)
*/
PyTypeObject *base = _PyType_CAST(PyTuple_GET_ITEM(bases, 0));
PyObject *base_mro = lookup_tp_mro(base);
+ assert(base_mro != NULL);
Py_ssize_t k = PyTuple_GET_SIZE(base_mro);
PyObject *result = PyTuple_New(k + 1);
if (result == NULL) {
@@ -3466,9 +3468,12 @@ mro_implementation_unlocked(PyTypeObject *type)
return NULL;
}
+ PyObject *mro_to_merge;
for (Py_ssize_t i = 0; i < n; i++) {
PyTypeObject *base = _PyType_CAST(PyTuple_GET_ITEM(bases, i));
- to_merge[i] = lookup_tp_mro(base);
+ mro_to_merge = lookup_tp_mro(base);
+ assert(mro_to_merge != NULL);
+ to_merge[i] = mro_to_merge;
}
to_merge[n] = bases;
@@ -8998,6 +9003,7 @@ type_ready_inherit(PyTypeObject *type)
// Inherit slots
PyObject *mro = lookup_tp_mro(type);
+ assert(mro != NULL);
Py_ssize_t n = PyTuple_GET_SIZE(mro);
for (Py_ssize_t i = 1; i < n; i++) {
PyObject *b = PyTuple_GET_ITEM(mro, i);
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
