https://github.com/python/cpython/commit/9c649dbaa80e905c9ccd874606cea706ca799a0d
commit: 9c649dbaa80e905c9ccd874606cea706ca799a0d
branch: main
author: Jelle Zijlstra <[email protected]>
committer: JelleZijlstra <[email protected]>
date: 2026-10-20T21:33:19-07:00
summary:
gh-159739: Keep generic alias arguments alive while formatting errors (#159981)
When a generic alias contains a list of parameters and an object claiming to be
an unpacked type-variable tuple returns a non-tuple from `__typing_subst__`,
the error path frees the temporary argument tuple before reading it to format a
`TypeError`. That use-after-free can crash the interpreter instead of reporting
the invalid substitution.
files:
A
Misc/NEWS.d/next/Core_and_Builtins/2026-10-20-00-00-00.gh-issue-159739.a3cc5d.rst
M Objects/genericaliasobject.c
diff --git
a/Misc/NEWS.d/next/Core_and_Builtins/2026-10-20-00-00-00.gh-issue-159739.a3cc5d.rst
b/Misc/NEWS.d/next/Core_and_Builtins/2026-10-20-00-00-00.gh-issue-159739.a3cc5d.rst
new file mode 100644
index 00000000000000..69c53e84e216b3
--- /dev/null
+++
b/Misc/NEWS.d/next/Core_and_Builtins/2026-10-20-00-00-00.gh-issue-159739.a3cc5d.rst
@@ -0,0 +1 @@
+Fix a crash when constructing an error for invalid generic alias arguments.
diff --git a/Objects/genericaliasobject.c b/Objects/genericaliasobject.c
index 18321d9948428f..2633b9af81c5b9 100644
--- a/Objects/genericaliasobject.c
+++ b/Objects/genericaliasobject.c
@@ -550,13 +550,13 @@ _Py_subs_parameters(PyObject *self, PyObject *args,
PyObject *parameters, PyObje
}
if (unpack) {
if (!PyTuple_Check(arg)) {
- Py_DECREF(newargs);
- Py_DECREF(item);
- Py_XDECREF(tuple_args);
PyObject *original = PyTuple_GET_ITEM(args, iarg);
PyErr_Format(PyExc_TypeError,
"expected __typing_subst__ of %T objects to
return a tuple, not %T",
original, arg);
+ Py_DECREF(newargs);
+ Py_DECREF(item);
+ Py_XDECREF(tuple_args);
Py_DECREF(arg);
return NULL;
}
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
