Crash from arbitrary code object hashing

Crash report

What happened?

When attempting to hash a code object that has arbitrary opcodes that include the INSTRUMENTED_* instructions, among others, the interpreter can crash with a segmentation fault. A simple reproducer is given by

from opcode import opmap

def f(): pass

hash(f.__code__.replace(co_code=bytes([opmap["INSTRUMENTED_LINE"], 0])))

This behaviour was introduced in 3.12 alongside the low-impact monitoring API. Whilst it is expected that executing arbitrary opcodes can lead to crashes, simply hashing a Python object should not have such strong side effects. A more real-life example can be obtained with the use of PyArmor to obfuscate bytecode. Attempting to hash an obfuscated code object can lead to a segmentation fault for the reason mentioned above.

CPython versions tested on:

3.12, 3.13, 3.14, 3.15, 3.16, CPython main branch

Operating systems tested on:

macOS

Output from running 'python -VV' on the command line:

No response

Linked PRs

• gh-154986

Inizia con il riproduttore che utilizza opcode.opmap, code.replace e hash(code), quindi esamina il PR collegato gh-154986 per comprendere il contesto dell’implementazione. Il lavoro è completato quando il calcolo dell’hash di un oggetto code contenente opcode INSTRUMENTED_* arbitrari non causa più un segmentation fault nelle versioni di CPython interessate.