python / python/cpython

`_remote_debugging`: `BinaryWriter.write_sample()` trivial segfault

Open
#157,227 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

extension-modules topic-profiling type-bug
Dominant language
Python
Stars
77.2k
Forks
35.9k
PR merge metrics
PR metrics pending

Description

Bug report

Bug description:
[139] 2026-09-09T18:57:09.249268000+0200 maurycy@gimel /Users/maurycy/work/cpython (main 52ffffe) % ./python.exe 
Python 3.16.0a0 (heads/main:83dbe6ae9f4, Sep  6 2026, 18:18:16) [Clang 21.0.0 (clang-2100.1.1.101)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import _remote_debugging
>>> _remote_debugging.BinaryWriter("/tmp/o.bin", 1000, 1000000).write_sample([42], 2000)
zsh: segmentation fault  ./python.exe

There's many more variants, easy to come up with.

This is the place:

https://github.com/python/cpython/blob/52ffffe0a23bf0f4a57ee00377c5aeb965b3a29a/Modules/_remote_debugging/binary_io_writer.c#L1013

It only checks if it's a list, and then it trusts completely:

https://github.com/python/cpython/blob/52ffffe0a23bf0f4a57ee00377c5aeb965b3a29a/Modules/_remote_debugging/binary_io_writer.c#L841-L848

https://github.com/python/cpython/blob/52ffffe0a23bf0f4a57ee00377c5aeb965b3a29a/Modules/_remote_debugging/binary_io_writer.c#L928-L930

https://github.com/python/cpython/blob/52ffffe0a23bf0f4a57ee00377c5aeb965b3a29a/Modules/_remote_debugging/binary_io_writer.c#L1020-L1023

The comment says Use unchecked accessors since we control the data structures but I still think that segmentation fault on a public method is not great.

I will submit a PR soon.

ref #148178

CPython versions tested on:

CPython main branch

Operating systems tested on:

macOS

Linked PRs
  • gh-157228

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in Modules/_remote_debugging/binary_io_writer.c at BinaryWriter.write_sample() and the referenced unchecked-accessor locations. Reproduce the crash with the provided BinaryWriter(...).write_sample([42], 2000) call, then verify that invalid public inputs no longer segfault and that the behavior is covered by appropriate regression testing.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, python
Domain
devtools
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.