https://github.com/python/cpython/commit/aa5ad5059753270caa052d4480d6489ca1e15ca9
commit: aa5ad5059753270caa052d4480d6489ca1e15ca9
branch: 3.13
author: sobolevn <[email protected]>
committer: sobolevn <[email protected]>
date: 2026-01-15T15:27:31Z
summary:
[3.13] gh-143635: Fix crash in `ga_repr_items_list` (GH-143670) (#143852)
(cherry picked from commit bdba5f0db2ab29f3deedb9416f3c143d33e4ab66)
files:
A Misc/NEWS.d/next/Core and
Builtins/2026-01-11-20-11-36.gh-issue-143670.klnGoD.rst
M Lib/test/test_genericalias.py
M Objects/genericaliasobject.c
diff --git a/Lib/test/test_genericalias.py b/Lib/test/test_genericalias.py
index 4a87e2bf7a1864..00dc9251e0ee3b 100644
--- a/Lib/test/test_genericalias.py
+++ b/Lib/test/test_genericalias.py
@@ -232,6 +232,56 @@ class MyGeneric:
self.assertTrue(repr(MyGeneric[[]]).endswith('MyGeneric[[]]'))
self.assertTrue(repr(MyGeneric[[int, str]]).endswith('MyGeneric[[int,
str]]'))
+ def test_evil_repr1(self):
+ # gh-143635
+ class Zap:
+ def __init__(self, container):
+ self.container = container
+ def __getattr__(self, name):
+ if name == "__origin__":
+ self.container.clear()
+ return None
+ if name == "__args__":
+ return ()
+ raise AttributeError
+
+ params = []
+ params.append(Zap(params))
+ alias = GenericAlias(list, (params,))
+ repr_str = repr(alias)
+ self.assertTrue(repr_str.startswith("list[["), repr_str)
+
+ def test_evil_repr2(self):
+ class Zap:
+ def __init__(self, container):
+ self.container = container
+ def __getattr__(self, name):
+ if name == "__qualname__":
+ self.container.clear()
+ return "abcd"
+ if name == "__module__":
+ return None
+ raise AttributeError
+
+ params = []
+ params.append(Zap(params))
+ alias = GenericAlias(list, (params,))
+ repr_str = repr(alias)
+ self.assertTrue(repr_str.startswith("list[["), repr_str)
+
+ def test_evil_repr3(self):
+ # gh-143823
+ lst = []
+ class X:
+ def __repr__(self):
+ lst.clear()
+ return "x"
+
+ lst += [X(), 1]
+ ga = GenericAlias(int, lst)
+ with self.assertRaises(IndexError):
+ repr(ga)
+
def test_exposed_type(self):
import types
a = types.GenericAlias(list, int)
diff --git a/Misc/NEWS.d/next/Core and
Builtins/2026-01-11-20-11-36.gh-issue-143670.klnGoD.rst b/Misc/NEWS.d/next/Core
and Builtins/2026-01-11-20-11-36.gh-issue-143670.klnGoD.rst
new file mode 100644
index 00000000000000..4ce0e71a47e145
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and
Builtins/2026-01-11-20-11-36.gh-issue-143670.klnGoD.rst
@@ -0,0 +1 @@
+Fixes a crash in ``ga_repr_items_list`` function.
diff --git a/Objects/genericaliasobject.c b/Objects/genericaliasobject.c
index 4bb84f054dd3dd..8e59b3884cf529 100644
--- a/Objects/genericaliasobject.c
+++ b/Objects/genericaliasobject.c
@@ -133,10 +133,15 @@ ga_repr_items_list(_PyUnicodeWriter *writer, PyObject *p)
return -1;
}
}
- PyObject *item = PyList_GET_ITEM(p, i);
+ PyObject *item = PyList_GetItemRef(p, i);
+ if (item == NULL) {
+ return -1; // list can be mutated in a callback
+ }
if (ga_repr_item(writer, item) < 0) {
+ Py_DECREF(item);
return -1;
}
+ Py_DECREF(item);
}
if (_PyUnicodeWriter_WriteASCIIString(writer, "]", 1) < 0) {
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
