https://github.com/python/cpython/commit/eca0efea19d1369d2a2c9ff2b1c29dc512424552 commit: eca0efea19d1369d2a2c9ff2b1c29dc512424552 branch: 3.13 author: Miss Islington (bot) <[email protected]> committer: JelleZijlstra <[email protected]> date: 2026-07-06T17:36:17+01:00 summary:
[3.13] gh-152682: Fix NULL dereference on OOM in `symtable_visit_type_param_bound_or_default` (GH-152684) (#152697) In `symtable_visit_type_param_bound_or_default()`, when a reserved name (e.g. `__classdict__`) is used as a type parameter, `PyUnicode_FromFormat()` is called to build the SyntaxError message. If the allocation fails and returns NULL, the subsequent `PyErr_SetObject()` and `Py_DECREF()` calls would dereference NULL, causing a segfault. Fix by returning 0 immediately when `PyUnicode_FromFormat()` returns NULL. This propagates the MemoryError set by `PyUnicode_FromFormat()`. The bug was introduced in gh-128632 (commit 891c61c). (cherry picked from commit 10ed03edf128ed1101ab8d04bcd715f2033fec55) Co-authored-by: Petr Vaganov <[email protected]> * Remove test --------- Co-authored-by: Petr Vaganov <[email protected]> Co-authored-by: Stan Ulbrych <[email protected]> files: A Misc/NEWS.d/next/Core_and_Builtins/2026-06-30-14-00-00.gh-issue-152682.yId7e5.rst M Python/symtable.c diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-06-30-14-00-00.gh-issue-152682.yId7e5.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-30-14-00-00.gh-issue-152682.yId7e5.rst new file mode 100644 index 000000000000000..aba0b594382bcf8 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-30-14-00-00.gh-issue-152682.yId7e5.rst @@ -0,0 +1,3 @@ +Fix NULL pointer dereference in :func:`compile` when a reserved name (e.g. +``__classdict__``) is used as a type parameter name and memory allocation +fails while formatting the error message. diff --git a/Python/symtable.c b/Python/symtable.c index f60af2b6955d71c..ece994cf0910cbc 100644 --- a/Python/symtable.c +++ b/Python/symtable.c @@ -2318,6 +2318,9 @@ symtable_visit_type_param_bound_or_default( PyObject *error_msg = PyUnicode_FromFormat("reserved name '%U' cannot be " "used for type parameter", name); + if (error_msg == NULL) { + return 0; + } PyErr_SetObject(PyExc_SyntaxError, error_msg); Py_DECREF(error_msg); PyErr_RangedSyntaxLocationObject(st->st_filename, _______________________________________________ Python-checkins mailing list -- [email protected] To unsubscribe send an email to [email protected] https://mail.python.org/mailman3//lists/python-checkins.python.org Member address: [email protected]
