https://github.com/python/cpython/commit/84118796a5177c5e424aaf6b126dc2fd09893756 commit: 84118796a5177c5e424aaf6b126dc2fd09893756 branch: 3.15 author: Miss Islington (bot) <[email protected]> committer: JelleZijlstra <[email protected]> date: 2026-10-21T11:50:16-07:00 summary:
[3.15] gh-159739: Keep generic alias arguments alive while formatting errors (GH-159981) (#160020) When a generic alias contains a list of parameters and an object claiming to be an unpacked type-variable tuple returns a non-tuple from `__typing_subst__`, the error path frees the temporary argument tuple before reading it to format a `TypeError`. That use-after-free can crash the interpreter instead of reporting the invalid substitution. (cherry picked from commit 9c649dbaa80e905c9ccd874606cea706ca799a0d) Co-authored-by: Jelle Zijlstra <[email protected]> files: A Misc/NEWS.d/next/Core_and_Builtins/2026-10-20-00-00-00.gh-issue-159739.a3cc5d.rst M Objects/genericaliasobject.c diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-10-20-00-00-00.gh-issue-159739.a3cc5d.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-10-20-00-00-00.gh-issue-159739.a3cc5d.rst new file mode 100644 index 00000000000000..69c53e84e216b3 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-10-20-00-00-00.gh-issue-159739.a3cc5d.rst @@ -0,0 +1 @@ +Fix a crash when constructing an error for invalid generic alias arguments. diff --git a/Objects/genericaliasobject.c b/Objects/genericaliasobject.c index 18321d9948428f..2633b9af81c5b9 100644 --- a/Objects/genericaliasobject.c +++ b/Objects/genericaliasobject.c @@ -550,13 +550,13 @@ _Py_subs_parameters(PyObject *self, PyObject *args, PyObject *parameters, PyObje } if (unpack) { if (!PyTuple_Check(arg)) { - Py_DECREF(newargs); - Py_DECREF(item); - Py_XDECREF(tuple_args); PyObject *original = PyTuple_GET_ITEM(args, iarg); PyErr_Format(PyExc_TypeError, "expected __typing_subst__ of %T objects to return a tuple, not %T", original, arg); + Py_DECREF(newargs); + Py_DECREF(item); + Py_XDECREF(tuple_args); Py_DECREF(arg); return NULL; } _______________________________________________ Python-checkins mailing list -- [email protected] To unsubscribe send an email to [email protected] https://mail.python.org/mailman3//lists/python-checkins.python.org Member address: [email protected]
