https://github.com/python/cpython/commit/5b96d3914767dc71cb21fd3448f5ded4fd85d957
commit: 5b96d3914767dc71cb21fd3448f5ded4fd85d957
branch: main
author: tonghuaroot (童话) <[email protected]>
committer: serhiy-storchaka <[email protected]>
date: 2026-08-16T19:07:02+03:00
summary:
gh-151895: Fix marshal.loads() crash on dict reference-tracking failure
(GH-151896)
Loading a reference-tracked dictionary dereferenced a NULL pointer when
the allocation that registers it for back-references failed under low
memory. It now raises MemoryError, matching the tuple and list paths.
files:
A
Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-11-05-56.gh-issue-151895.QQsjUQ.rst
M Python/marshal.c
diff --git
a/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-11-05-56.gh-issue-151895.QQsjUQ.rst
b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-11-05-56.gh-issue-151895.QQsjUQ.rst
new file mode 100644
index 00000000000000..e17b340348b06b
--- /dev/null
+++
b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-11-05-56.gh-issue-151895.QQsjUQ.rst
@@ -0,0 +1,2 @@
+Fixed a crash in :func:`marshal.loads` when an allocation failed while
+loading a reference-tracked dictionary; it now raises :exc:`MemoryError`.
diff --git a/Python/marshal.c b/Python/marshal.c
index 25353f6e689624..603697e9081c59 100644
--- a/Python/marshal.c
+++ b/Python/marshal.c
@@ -1471,6 +1471,9 @@ r_object(RFILE *p)
}
if (type == TYPE_DICT) {
R_REF(v);
+ if (v == NULL) {
+ break;
+ }
}
else {
idx = r_ref_reserve(flag, p);
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
