Skip to content

gh-142555: Fix null pointer dereference in array.__setitem__ via re-entrant __index__ #142713

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
encukou merged 22 commits into from
Feb 2, 2026
Merged

gh-142555: Fix null pointer dereference in array.__setitem__ via re-entrant __index__ #142713

Changes from 1 commit
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
71fc725
Fix null pointer dereference in array.__setitem__ via re-entrant __in…
aisk Dec 14, 2025
6c437d5
Update Misc/NEWS.d/next/Core_and_Builtins/2025-12-15-02-02-45.gh-issu…
aisk Dec 15, 2025
e3c728a
Move the news entry to library folder
aisk Dec 15, 2025
67e98b5
Also check if the ob_item's size is changed by user's code
aisk Dec 17, 2025
ad18d48
Add check on more *_setitem methods
aisk Dec 17, 2025
c408c57
Check other setitem methods
aisk Dec 18, 2025
95e4eec
Reduce the comments
aisk Dec 18, 2025
fc6f987
Re-order the test
aisk Dec 18, 2025
c8cbd28
Refactor the array check codes to a function
aisk Dec 19, 2025
0b3db3c
Change the bound check from function to macro
aisk Dec 20, 2025
8eeba89
Revert the format changed made by IDE automatically
aisk Dec 20, 2025
e00b7a4
Revert more format changes
aisk Dec 20, 2025
2b6d5dc
Revert more format changes
aisk Dec 20, 2025
c83b64a
Revert more format test
aisk Dec 20, 2025
d0ff678
Update news entry
aisk Dec 20, 2025
e865d0d
Update Misc/NEWS.d/next/Library/2025-12-15-02-02-45.gh-issue-142555.E…
aisk Dec 27, 2025
0ad0f28
Refactor tests
aisk Dec 27, 2025
b3617c8
Format the macro by PEP7
aisk Dec 27, 2025
deccbf0
Update by review comments
aisk Dec 27, 2025
a4dab68
Simplify the test
aisk Dec 27, 2025
1befa98
Update comment
aisk Dec 27, 2025
37ed8f8
Update Lib/test/test_array.py
aisk Dec 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 13 additions & 16 deletions Lib/test/test_array.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1681,24 +1681,25 @@ def test_gh_128961(self):
it.__setstate__(0)
self.assertRaises(StopIteration, next, it)

# Tests for NULL pointer dereference in array.__setitem__
# when the index conversion mutates the array.
# See: gh-142555.
Comment thread
aisk marked this conversation as resolved.
Outdated
@subTests(
("dtype", "items"),
[
("b", [0] * 64),
("B", [1, 2, 3]),
("h", [1, 2, 3]),
("H", [1, 2, 3]),
("i", [1, 2, 3]),
("l", [1, 2, 3]),
("q", [1, 2, 3]),
("I", [1, 2, 3]),
("L", [1, 2, 3]),
("Q", [1, 2, 3]),
("b", list(range(64))),
("B", list(range(64))),
("h", list(range(64))),
("H", list(range(64))),
("i", list(range(64))),
("l", list(range(64))),
("q", list(range(64))),
("I", list(range(64))),
("L", list(range(64))),
("Q", list(range(64))),
Comment thread
aisk marked this conversation as resolved.
Outdated
],
)
def test_setitem_use_after_clear_with_int_data(self, dtype, items):
# gh-142555: Test for null pointer dereference in array.__setitem__
# via re-entrant __index__ that clears the array.
victim = array.array(dtype, items)

class Index:
Expand All @@ -1710,8 +1711,6 @@ def __index__(self):
self.assertEqual(len(victim), 0)

def test_setitem_use_after_shrink_with_int_data(self):
# gh-142555: Test for null pointer dereference in array.__setitem__
# via re-entrant __index__ that shrinks the array.
victim = array.array('b', [1, 2, 3])

class Index:
Expand All @@ -1724,8 +1723,6 @@ def __index__(self):

@subTests("dtype", ["f", "d"])
def test_setitem_use_after_clear_with_float_data(self, dtype):
# gh-142555: Test for null pointer dereference in array.__setitem__
# via re-entrant __float__ that clears the array.
victim = array.array(dtype, [1.0, 2.0, 3.0])

class Float:
Expand Down
Loading