[3.14] gh-150146: Fix NULL dereference in `_Py_subs_parameters` (GH-150147) (#150154)

gh-150146: Fix NULL dereference in `_Py_subs_parameters` (GH-150147)
(cherry picked from commit f621ba16b72510e1abc9646a844a632df4ac275c)

Co-authored-by: sobolevn <mail@sobolevn.me>

diff --git a/Lib/test/test_genericalias.py b/Lib/test/test_genericalias.py
index 4f5b10650acdea0ef032067aeec64576533e504f..121d169dd07285a5a338049aa6e717037d33acf4 100644 (file)
--- a/Lib/test/test_genericalias.py
+++ b/Lib/test/test_genericalias.py
@@ -55,15 +55,14 @@ from urllib.parse import SplitResult, ParseResult
 from unittest.case import _AssertRaisesContext
 from queue import Queue, SimpleQueue
 from weakref import WeakSet, ReferenceType, ref
-import typing
-from typing import Unpack
 try:
     from tkinter import Event
 except ImportError:
     Event = None
 from string.templatelib import Template, Interpolation
 
-from typing import TypeVar
+import typing
+from typing import TypeVar, Unpack
 T = TypeVar('T')
 K = TypeVar('K')
 V = TypeVar('V')
@@ -619,6 +618,14 @@ class BaseTest(unittest.TestCase):
         self.assertEqual(deeply_nested_specialized.__args__, ([str, [float], int], float))
         self.assertEqual(deeply_nested_specialized.__parameters__, ())
 
+    def test_gh150146(self):
+        # It used to crash:
+        for container in [memoryview, list, tuple]:
+            with self.subTest(container=container):
+                x = container[TypeVar("")]
+                with self.assertRaises(TypeError):
+                    x[*typing.Mapping[..., ...]]
+
 
 class TypeIterationTests(unittest.TestCase):
     _UNITERABLE_TYPES = (list, tuple)

diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-05-20-13-06-17.gh-issue-150146.i5m_SL.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-05-20-13-06-17.gh-issue-150146.i5m_SL.rst
new file mode 100644 (file)
index 0000000..f373f0b
--- /dev/null
+++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-05-20-13-06-17.gh-issue-150146.i5m_SL.rst
@@ -0,0 +1,5 @@
+Fix a crash on a complex type variable substitution.
+
+``from typing import TypeVar; memoryview[TypeVar("")][*typing.Mapping[...,
+...]]`` used to fail due to missing ``NULL`` check on ``_unpack_args`` C
+function call.

diff --git a/Objects/genericaliasobject.c b/Objects/genericaliasobject.c
index 7c518e19c7d2313c1b3455c72bfbe33c583355d3..6e4dc7d6d48969c2d2dabe7233a954971639f467 100644 (file)
--- a/Objects/genericaliasobject.c
+++ b/Objects/genericaliasobject.c
@@ -410,6 +410,9 @@ _Py_subs_parameters(PyObject *self, PyObject *args, PyObject *parameters, PyObje
                             self);
     }
     item = _unpack_args(item);
+    if (item == NULL) {
+        return NULL;
+    }
     for (Py_ssize_t i = 0; i < nparams; i++) {
         PyObject *param = PyTuple_GET_ITEM(parameters, i);
         PyObject *prepare, *tmp;