https://github.com/python/cpython/commit/edbc1fe09f046ccbe885051d93cf65d253ba0867 commit: edbc1fe09f046ccbe885051d93cf65d253ba0867 branch: 3.15 author: Miss Islington (bot) <[email protected]> committer: kumaraditya303 <[email protected]> date: 2026-07-14T16:52:23Z summary:
[3.15] gh-151912: Fix segfault in `type()` with NULL `tp_new` metaclasses (GH-151916) (#153707) gh-151912: Fix segfault in `type()` with NULL `tp_new` metaclasses (GH-151916) (cherry picked from commit f160f16373f9ea3f636bc5cd6fb4be7e150bb27f) Co-authored-by: Santhosh .I 🦇 <[email protected]> files: A Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst M Lib/test/test_descr.py M Objects/typeobject.c diff --git a/Lib/test/test_descr.py b/Lib/test/test_descr.py index 8a8e70214e27ae..ba504119d294fd 100644 --- a/Lib/test/test_descr.py +++ b/Lib/test/test_descr.py @@ -815,6 +815,15 @@ class X(C, int()): class X(int(), C): pass + @unittest.skipIf(_testcapi is None, 'need the _testcapi module') + def test_type_with_null_new_metaclass(self): + metaclass = _testcapi.HeapCTypeMetaclassNullNew + base = _testcapi.pytype_fromspec_meta(metaclass) + + # Exercise type_new's metaclass selection path, not a direct call. + with self.assertRaisesRegex(TypeError, r"cannot create '.*' instances"): + type("Derived", (base,), {}) + def test_module_subclasses(self): # Testing Python subclass of module... log = [] diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst new file mode 100644 index 00000000000000..07b73949b438a3 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst @@ -0,0 +1 @@ +Fixed a crash in ``type()`` when selecting a metaclass whose ``tp_new`` slot is ``NULL``. Such metaclasses are now rejected with ``TypeError`` instead of causing a NULL pointer dereference. diff --git a/Objects/typeobject.c b/Objects/typeobject.c index 969ae450013a31..f763f9f5eba58f 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -5026,6 +5026,13 @@ type_new_get_bases(type_new_ctx *ctx, PyObject **type) if (winner != ctx->metatype) { if (winner->tp_new != type_new) { + /* Check if tp_new is NULL (cannot instantiate this type) */ + if (winner->tp_new == NULL) { + PyErr_Format(PyExc_TypeError, + "cannot create '%.400s' instances", + winner->tp_name); + return -1; + } /* Pass it to the winner */ *type = winner->tp_new(winner, ctx->args, ctx->kwds); if (*type == NULL) { _______________________________________________ Python-checkins mailing list -- [email protected] To unsubscribe send an email to [email protected] https://mail.python.org/mailman3//lists/python-checkins.python.org Member address: [email protected]
