]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
[3.14] gh-152682: Fix NULL dereference on OOM in `symtable_visit_type_param_bound_or_...
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Mon, 6 Jul 2026 16:35:58 +0000 (18:35 +0200)
committerGitHub <noreply@github.com>
Mon, 6 Jul 2026 16:35:58 +0000 (17:35 +0100)
commit0903be826a27bb949d53095461baebc2ee2eea1f
tree6c13f28de3c7f36b8eadcad0c4c33949bc9d8f6a
parent40771bf1749c254e9ba795a456f31739d5005b2b
[3.14] gh-152682: Fix NULL dereference on OOM in `symtable_visit_type_param_bound_or_default` (GH-152684) (#152696)

In `symtable_visit_type_param_bound_or_default()`, when a reserved name
(e.g. `__classdict__`) is used as a type parameter, `PyUnicode_FromFormat()`
is called to build the SyntaxError message. If the allocation fails and
returns NULL, the subsequent `PyErr_SetObject()` and `Py_DECREF()` calls
would dereference NULL, causing a segfault.

Fix by returning 0 immediately when `PyUnicode_FromFormat()` returns NULL.
This propagates the MemoryError set by `PyUnicode_FromFormat()`.

The bug was introduced in gh-128632 (commit 891c61c).
(cherry picked from commit 10ed03edf128ed1101ab8d04bcd715f2033fec55)

Co-authored-by: Petr Vaganov <petrvaganoff@gmail.com>
* Remove test

---------

Co-authored-by: Petr Vaganov <petrvaganoff@gmail.com>
Co-authored-by: Stan Ulbrych <stan@python.org>
Misc/NEWS.d/next/Core_and_Builtins/2026-06-30-14-00-00.gh-issue-152682.yId7e5.rst [new file with mode: 0644]
Python/symtable.c