From 32feeff72de6c43557fc3b7815964dc55c74535c Mon Sep 17 00:00:00 2001 From: sobolevn Date: Wed, 20 May 2026 17:04:17 +0300 Subject: [PATCH] [3.13] gh-150146: Fix NULL dereference in `_Py_subs_parameters` (GH-150147) (#150155) * [3.13] gh-150146: Fix NULL dereference in `_Py_subs_parameters` (GH-150147) (cherry picked from commit f621ba16b72510e1abc9646a844a632df4ac275c) Co-authored-by: sobolevn --- Lib/test/test_genericalias.py | 10 ++++++++-- .../2026-05-20-13-06-17.gh-issue-150146.i5m_SL.rst | 5 +++++ Objects/genericaliasobject.c | 3 +++ 3 files changed, 16 insertions(+), 2 deletions(-) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-05-20-13-06-17.gh-issue-150146.i5m_SL.rst diff --git a/Lib/test/test_genericalias.py b/Lib/test/test_genericalias.py index 00dc9251e0ee..685bddfba70a 100644 --- a/Lib/test/test_genericalias.py +++ b/Lib/test/test_genericalias.py @@ -56,9 +56,8 @@ from unittest.case import _AssertRaisesContext from queue import Queue, SimpleQueue from weakref import WeakSet, ReferenceType, ref import typing -from typing import Unpack +from typing import TypeVar, Unpack -from typing import TypeVar T = TypeVar('T') K = TypeVar('K') V = TypeVar('V') @@ -537,6 +536,13 @@ class BaseTest(unittest.TestCase): iter_x = iter(t) del iter_x + def test_gh150146(self): + # It used to crash: + for container in [list, tuple]: + with self.subTest(container=container): + x = container[TypeVar("")] + with self.assertRaises(TypeError): + x[*typing.Mapping[..., ...]] class TypeIterationTests(unittest.TestCase): _UNITERABLE_TYPES = (list, tuple) diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-05-20-13-06-17.gh-issue-150146.i5m_SL.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-05-20-13-06-17.gh-issue-150146.i5m_SL.rst new file mode 100644 index 000000000000..f373f0bee702 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-05-20-13-06-17.gh-issue-150146.i5m_SL.rst @@ -0,0 +1,5 @@ +Fix a crash on a complex type variable substitution. + +``from typing import TypeVar; memoryview[TypeVar("")][*typing.Mapping[..., +...]]`` used to fail due to missing ``NULL`` check on ``_unpack_args`` C +function call. diff --git a/Objects/genericaliasobject.c b/Objects/genericaliasobject.c index 30759ca0e0eb..bbb4f77d4a9e 100644 --- a/Objects/genericaliasobject.c +++ b/Objects/genericaliasobject.c @@ -443,6 +443,9 @@ _Py_subs_parameters(PyObject *self, PyObject *args, PyObject *parameters, PyObje self); } item = _unpack_args(item); + if (item == NULL) { + return NULL; + } for (Py_ssize_t i = 0; i < nparams; i++) { PyObject *param = PyTuple_GET_ITEM(parameters, i); PyObject *prepare, *tmp; -- 2.47.3