python / python/cpython

segfault caused by unchecked PyUnicode_AsUTF8 in `_interpreters` module

Ouverte
#156,117 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Personne n'a encore pris cette issue.

interpreter-core topic-subinterpreters type-crash
Langage dominant
Python
Étoiles
77.2k
Forks
35.9k
Métriques de merge des PR
Métriques de PR en attente

Description

Crash report

What happened?
> python -c 'import _interpreters; _interpreters.new_config(gil="\\ud800")'
fish: Job 1, 'python -c 'import _interpreters…' terminated by signal SIGSEGV (Address boundary error)

interpconfig.c _config_dict_copy_str
https://github.com/python/cpython/blob/e8158d1a02d6e5e974d4dbc0633b6a3ad960d7a3/Python/interpconfig.c#L136
does an unchecked PyUnicode_AsUTF8 which triggers a failure if the gil value contains a unicode lone surrogate.

LLDB trace
> lldb ./python.exe -- -c 'import _interpreters; _interpreters.new_config(gil="\\ud800")'
(lldb) target create "./python.exe"
Current executable set to '~/src/tp/cpython/python.exe' (arm64).
(lldb) settings set -- target.run-args  "-c" "import _interpreters; _interpreters.new_config(gil=\"\\ud800\")"
(lldb) run
Process 16834 launched: '~/src/tp/cpython/python.exe' (arm64)
Process 16834 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
       frame #0: 0x000000019c4a1cb8 libsystem_platform.dylib`_platform_strncpy + 32
libsystem_platform.dylib`_platform_strncpy:
->  0x19c4a1cb8 <+32>: ldr    q0, [x11]


python.exe │ EXC_BAD_ACCESS (code=1, address=0x0)

(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
   * frame #0: 0x000000019c4a1cb8 libsystem_platform.dylib`_platform_strncpy + 32
     frame #1: 0x000000010029e784 python.exe`_config_dict_copy_str(dict=0x00000001055d7b90, name="gil", buf="", bufsize=20) at interpconfig.c:136:5 [opt]
     frame #2: 0x000000010029e2e0 python.exe`interp_config_from_dict(origdict=0x00000001055d7a10, config=0x000000016fdfd51c, missing_allowed=true) at interpconfig.c:188:9 [opt]
     frame #3: 0x000000010029e498 python.exe`_PyInterpreterConfig_UpdateFromDict(config=0x000000016fdfd51c, dict=0x00000001055d7a10) at interpconfig.c:243:9 [opt]
     frame #4: 0x0000000100a4882c _interpreters.cpython-316d-darwin.so`interp_new_config(self=0x000000010563b770, args=0x000000010062a618, kwds=0x00000001055d7a10) at _interpretersmodule.c:822:13 [opt]
     frame #5: 0x000000010010d878 python.exe`cfunction_call(func=0x00000001055fac90, args=0x000000010062a618, kwargs=0x00000001055d7a10) at methodobject.c:564:18 [opt]
     frame #6: 0x0000000100098df0 python.exe`_PyObject_MakeTpCall(tstate=0x0000000100649cf8, callable=0x00000001055fac90, args=0x000000016fdfd680, nargs=0, keywords=0x000000010556d180) at call.c:242:18 [opt]
     frame #7: 0x0000000100098a80 python.exe`_PyObject_VectorcallTstate(tstate=<unavailable>, callable=<unavailable>, args=<unavailable>, nargsf=<unavailable>, kwnames=<unavailable>) at pycore_call.h:142:16 [opt] [artificial]
     frame #8: 0x00000001000998dc python.exe`PyObject_Vectorcall(callable=<unavailable>, args=<unavailable>, nargsf=<unavailable>, kwnames=<unavailable>) at call.c:327:12 [opt] [artificial]
     frame #9: 0x0000000100213bd4 python.exe`_Py_VectorCallInstrumentation_StackRefSteal(callable=(bits = 4385123472), arguments=0x0000000100a28080, total_args=1, kwnames=(bits = 4384543105), call_instrumentation=false, frame=0x0000000100a28020, this_instr=0x00000001055ec7f0, tstate=0x0000000100649cf8) at ceval.c:768:11 [opt]
     frame #10: 0x000000010021dd58 python.exe`_PyEval_EvalFrameDefault(tstate=<unavailable>, frame=0x0000000100a28020, throwflag=<unavailable>) at generated_cases.c.h:3474:35 [opt]
     frame #11: 0x00000001002134bc python.exe`_PyEval_EvalFrame(tstate=0x0000000100649cf8, frame=0x0000000100a28020, throwflag=0) at pycore_ceval.h:122:16 [opt] [inlined]
     frame #12: 0x00000001002134ac python.exe`_PyEval_Vector(tstate=0x0000000100649cf8, func=<unavailable>, locals=0x00000001055d79b0, args=<unavailable>, argcount=0, kwnames=0x0000000000000000) at ceval.c:2172:12 [opt]
     frame #13: 0x0000000100213220 python.exe`PyEval_EvalCode(co=0x00000001055ec700, globals=0x00000001055d79b0, locals=0x00000001055d79b0) at ceval.c:679:21 [opt]
     frame #14: 0x00000001002e12bc python.exe`run_eval_code_obj(tstate=0x0000000100649cf8, co=0x00000001055ec700, globals=0x00000001055d79b0, locals=0x00000001055d79b0) at pythonrun.c:1406:12 [opt]
     frame #15: 0x00000001002e0dd4 python.exe`run_mod(mod=<unavailable>, filename=0x00000001055ea340, globals=<unavailable>, locals=0x00000001055d79b0, flags=<unavailable>, arena=<unavailable>, interactive_src=<unavailable>, generate_new_source=<unavailable>) at pythonrun.c:1509:19 [opt]
     frame #16: 0x00000001002de904 python.exe`_PyRun_String(str="import _interpreters; _interpreters.new_config(gil=\"\\ud800\")\n", name=0x00000001055ea340, start=257, globals=0x00000001055d79b0, locals=0x00000001055d79b0, flags=0x000000016fdfea20, generate_new_source=0) at pythonrun.c:1292:15 [opt]
     frame #17: 0x00000001002de720 python.exe`_PyRun_SimpleString(command="import _interpreters; _interpreters.new_config(gil=\"\\ud800\")\n", name=0x00000001055ea340, flags=0x000000016fdfea20) at pythonrun.c:590:21 [opt]
     frame #18: 0x0000000100311198 python.exe`pymain_run_command(command=<unavailable>) at main.c:308:18 [opt] [inlined]
     frame #19: 0x0000000100311074 python.exe`pymain_run_python(exitcode=0x000000016fdfe9dc) at main.c:795:21 [opt] [inlined]
     frame #20: 0x0000000100310c54 python.exe`Py_RunMain at main.c:891:5 [opt]
     frame #21: 0x0000000100311590 python.exe`pymain_main(args=0x000000016fdfed00) at main.c:921:12 [opt]
     frame #22: 0x00000001003115e0 python.exe`Py_BytesMain(argc=3, argv=0x000000016fdff3d0) at main.c:945:12 [opt]
     frame #23: 0x000000019c0c3e88 dyld`start + 6688
CPython versions tested on:

3.14

Operating systems tested on:

macOS

Output from running 'python -VV' on the command line:

Python 3.16.0a0 (heads/main:20e6c2fc7c1, Aug 19 2026, 16:27:32) [Clang 21.0.0 (clang-2100.3.27.1)]

Linked PRs
  • gh-156129

Guide de contribution

Ouvrir le guide de contribution

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Piste de recherche

Commencez à la ligne 136 de Python/interpconfig.c, puis suivez l’appel depuis la ligne 822 de _interpretersmodule.c et reproduisez le crash avec la commande indiquée. Vérifiez la PR liée gh-156129 et confirmez que l’entrée contenant un lone surrogate ne provoque plus de segmentation fault.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Évaluation

Stack technique
python
Domaine
backend
Type d'issue
Bug
Difficulté
3/5
Temps estimé
1-2 jours
Activité
À l'abandon
Clarté
Clairement spécifiée
Accessibilité débutants
35/100

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.