https://github.com/python/cpython/commit/2395a97f01abaccd13bd730e661f7005c1512613 commit: 2395a97f01abaccd13bd730e661f7005c1512613 branch: 3.15 author: Miss Islington (bot) <[email protected]> committer: serhiy-storchaka <[email protected]> date: 2026-10-10T12:52:14+03:00 summary:
[3.15] gh-151895: Fix marshal.loads() crash on dict reference-tracking failure (GH-151896) (GH-155902) Loading a reference-tracked dictionary dereferenced a NULL pointer when the allocation that registers it for back-references failed under low memory. It now raises MemoryError, matching the tuple and list paths. (cherry picked from commit 5b96d3914767dc71cb21fd3448f5ded4fd85d957) Co-authored-by: tonghuaroot (童话) <[email protected]> files: A Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-11-05-56.gh-issue-151895.QQsjUQ.rst M Python/marshal.c diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-11-05-56.gh-issue-151895.QQsjUQ.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-11-05-56.gh-issue-151895.QQsjUQ.rst new file mode 100644 index 00000000000000..e17b340348b06b --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-11-05-56.gh-issue-151895.QQsjUQ.rst @@ -0,0 +1,2 @@ +Fixed a crash in :func:`marshal.loads` when an allocation failed while +loading a reference-tracked dictionary; it now raises :exc:`MemoryError`. diff --git a/Python/marshal.c b/Python/marshal.c index 1269ebd18b210f..d1d9998b1aac31 100644 --- a/Python/marshal.c +++ b/Python/marshal.c @@ -1467,6 +1467,9 @@ r_object(RFILE *p) } if (type == TYPE_DICT) { R_REF(v); + if (v == NULL) { + break; + } } else { idx = r_ref_reserve(flag, p); _______________________________________________ Python-checkins mailing list -- [email protected] To unsubscribe send an email to [email protected] https://mail.python.org/mailman3//lists/python-checkins.python.org Member address: [email protected]
