https://github.com/python/cpython/commit/5ce1ef3e87bdd277a9ae78e73e5fb216ff953b3d
commit: 5ce1ef3e87bdd277a9ae78e73e5fb216ff953b3d
branch: main
author: Jelle Zijlstra <[email protected]>
committer: JelleZijlstra <[email protected]>
date: 2026-10-22T11:21:53-07:00
summary:
gh-159739: Keep SimpleQueue valid after buffer allocation fails (#160165)
If allocating a SimpleQueue buffer fails, the partially constructed object
reports nonzero capacity despite having no storage. A subclass finalizer that
calls put() then writes through a NULL pointer and crashes; publish the
capacity only after allocation succeeds. Backport to 3.15 and 3.14.
files:
A Misc/NEWS.d/next/Library/2026-10-21-19-55-00.gh-issue-159739.sque01.rst
M Modules/_queuemodule.c
diff --git
a/Misc/NEWS.d/next/Library/2026-10-21-19-55-00.gh-issue-159739.sque01.rst
b/Misc/NEWS.d/next/Library/2026-10-21-19-55-00.gh-issue-159739.sque01.rst
new file mode 100644
index 00000000000000..120caf1e27c6cb
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-10-21-19-55-00.gh-issue-159739.sque01.rst
@@ -0,0 +1,2 @@
+Avoid a crash when a :class:`queue.SimpleQueue` subclass finalizer adds an
+item after construction fails.
diff --git a/Modules/_queuemodule.c b/Modules/_queuemodule.c
index af54e42a6af584..6779193e402fac 100644
--- a/Modules/_queuemodule.c
+++ b/Modules/_queuemodule.c
@@ -51,13 +51,14 @@ RingBuf_Init(RingBuf *buf)
{
buf->put_idx = 0;
buf->get_idx = 0;
- buf->items_cap = INITIAL_RING_BUF_CAPACITY;
+ buf->items_cap = 0;
buf->num_items = 0;
- buf->items = PyMem_Calloc(buf->items_cap, sizeof(PyObject *));
+ buf->items = PyMem_Calloc(INITIAL_RING_BUF_CAPACITY, sizeof(PyObject *));
if (buf->items == NULL) {
PyErr_NoMemory();
return -1;
}
+ buf->items_cap = INITIAL_RING_BUF_CAPACITY;
return 0;
}
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
