Skip to content

gh-148222 Fix Null dereference bugs at genericaliasobject.c #148226

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
prakashsellathurai wants to merge 10 commits into
base: main
Choose a base branch
from
+3 −2
Open

gh-148222 Fix Null dereference bugs at genericaliasobject.c #148226

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
c954f91
Add Add NULL check and fallback to ga_vectorcall
prakashsellathurai Apr 7, 2026
01faae2
Add Null check to _Py_make_parameters when_PyTuple_Resize fails and
prakashsellathurai Apr 7, 2026
eb56ccf
Merge branch 'python:main' into fix/148222
prakashsellathurai Apr 7, 2026
31b5522
add changelog
prakashsellathurai Apr 7, 2026
e6a5d95
style: fix liting error
prakashsellathurai Apr 7, 2026
d7cccef
Merge branch 'python:main' into fix/148222
prakashsellathurai Apr 7, 2026
916a046
Merge branch 'python:main' into fix/148222
prakashsellathurai Apr 8, 2026
1defe5d
remove reduntant Py_XDECREF(param) call in genricalias object call
prakashsellathurai Apr 8, 2026
99b1ce9
remove redunatnt PyVectorcall_Function call in generic alias object c
prakashsellathurai Apr 8, 2026
b93f0bf
Update 2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst
prakashsellathurai Apr 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions Misc/NEWS.d/next/Core_and_Builtins/2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
1. Add Add NULL check and fallback to ga_vectorcall
2. Add Null check to _Py_make_parameters when_PyTuple_Resize fails and parameter is null
11 changes: 9 additions & 2 deletions Objects/genericaliasobject.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,7 +242,7 @@ _Py_make_parameters(PyObject *args)
len += needed;
if (_PyTuple_Resize(&parameters, len) < 0) {
Py_DECREF(subparams);
Py_DECREF(parameters);
Py_XDECREF(parameters);
Copy link
Copy Markdown
Member

@JelleZijlstra JelleZijlstra Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Apparently _PyTuple_Resize sets its arg to NULL on failures, so this will never be non-NULL. Possibly the only safe way to use _PyTuple_Resize is to keep another pointer to the tuple around and DECREF that on failure? I haven't verified in the code though.

Copy link
Copy Markdown
Member

@serhiy-storchaka serhiy-storchaka Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Simply remove this line.

Copy link
Copy Markdown
Author

@prakashsellathurai prakashsellathurai Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes

checked in

cpython/Objects/tupleobject.c

Line 1024 in 2c8f26c

Py_XDECREF(v);

removing the redundant Py_XDECREF call

Py_XDECREF(tuple_args);
return NULL;
}
Expand Down Expand Up @@ -650,7 +650,14 @@ ga_vectorcall(PyObject *self, PyObject *const *args,
size_t nargsf, PyObject *kwnames)
{
gaobject *alias = (gaobject *) self;
PyObject *obj = PyVectorcall_Function(alias->origin)(alias->origin, args, nargsf, kwnames);
vectorcallfunc origin_vectorcall = PyVectorcall_Function(alias->origin);
Copy link
Copy Markdown
Member

@JelleZijlstra JelleZijlstra Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The docs say this is primarily useful for checking whether a callable supports vectorcall. Why don't we unconditionally call PyObject_Vectorcall, which automatically falls back to non-vectorcall if needed?

Copy link
Copy Markdown
Author

@prakashsellathurai prakashsellathurai Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

makes sense
I checked the code flow PyObject_Vectorcall internally calls https://github.com/python/cpython/blob/main/Include/internal/pycore_call.h#L140-L142 PyVectorcall_Function

i will update the code

PyObject *obj;
if (origin_vectorcall != NULL) {
obj = origin_vectorcall(alias->origin, args, nargsf, kwnames);
} else {
/* Fallback to generic call path*/
obj = PyObject_Vectorcall(alias->origin, args, nargsf, kwnames);
}
return set_orig_class(obj, self);
}

Expand Down
Loading