python / python/cpython

`MemoryError` during parse can escalate to `SystemError` and abort on small input

Open
#150,001 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

interpreter-core topic-parser type-crash
Dominant language
Python
Stars
77.2k
Forks
35.9k
PR merge metrics
PR metrics pending

Description

Crash report

What happened?
string = (
    b'(*h(((h(h(h(' +
    b'[' * 35 +
    b'*h(' +
    b'[' * 38 +
    b'**h(' +
    b'[' * 31 +
    b'(' * 4 +
    b'~' * 20 +
    b'F{' +
    b'[' * 27 +
    b'**h(' +
    b'[' * 31 +
    b'(' * 4 +
    b'~' * 23 +
    b'F{F"{F"{F"{F"{F"{F"{F"{FF""{{F"{""{F"{F{{F"{F"{F"\\}'
)

compile(string, "<input>", "single")

Gives me:

Fatal Python error: _Py_CheckFunctionResult: a function returned a result with an exception set
Python runtime state: initialized
MemoryError: Parser stack overflowed - Python source too complex to parse

The above exception was the direct cause of the following exception:

SystemError: <class 'SyntaxWarning'> returned a result with an exception set

Current thread 0x00007efd1b8e8780 [python] (most recent call first):
  File "/tmp/repro.py", line 19 in <module>
Aborted                    (core dumped) ./python /tmp/repro.py

Found by OSS-Fuzz.

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Output from running 'python -VV' on the command line:

No response

Linked PRs
  • gh-150067

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Run the supplied compile() reproducer on CPython main and compare its MemoryError/SystemError failure with the reported fatal abort. Read the parser and SyntaxWarning handling involved, then review linked PR gh-150067. Done means the input no longer aborts the interpreter or escalates the parser error into a SystemError.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.