Commit graph

8428 commits

Author SHA1 Message Date
Bénédikt Tran
19fda670d6
[3.13] gh-142557: fix UAF in bytearray.__mod__ when object is mutated while formatting %-style arguments (GH-143213) (#143229)
(cherry picked from commit 61ee04834b)
2025-12-27 17:20:49 +00:00
Miss Islington (bot)
b3a0d15e3b
[3.13] gh-142664: fix PyObject_Hash invokation post GH-143217 (GH-143223) (#143225)
gh-142664: fix `PyObject_Hash` invokation post GH-143217 (GH-143223)
(cherry picked from commit 84fcdbd86e)

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
2025-12-27 14:53:13 +00:00
Bénédikt Tran
4fcb1d9819
[3.13] gh-142664: fix UAF in memoryview.__hash__ via re-entrant data's __hash__ (GH-143217) (#143222)
(cherry picked from commit 00e24b80e0)
2025-12-27 13:43:11 +00:00
Bénédikt Tran
8aca2fd87c
[3.13] gh-143195: fix UAF in {bytearray,memoryview}.hex(sep) via re-entrant sep.__len__ (GH-143209) (#143220)
(cherry picked from commit 9976c2b634)
2025-12-27 12:58:42 +00:00
Cody Maloney
a9e068f0be
[3.13] gh-142560: prevent use-after-free in search-like methods by exporting buffer in bytearray (GH-142938) (GH-142986)
(cherry picked from commit 220f0b1077)

Co-authored-by: wangxiaolei <fatelei@gmail.com>
2025-12-24 19:13:47 +00:00
Mikhail Efimov
4504ff89d5
[3.13] gh-140373: Correctly emit PY_UNWIND event when generator is closed (GH-140767) (#140821) 2025-12-20 16:21:11 +02:00
Sam Gross
db552ddb1e
[3.13] gh-142766: Clear frame when generator.close() is called (gh-142838) (#142900)
(cherry picked from commit 25397f9541)
2025-12-17 18:46:23 +00:00
Bartosz Sławecki
3e45440382
[3.13] gh-142737: Handle lost io.open in _Py_FindSourceFile (GH-142747) (GH-142774)
(cherry picked from commit f277781bba)
2025-12-15 23:27:15 +00:00
Bénédikt Tran
2249043874
[3.13] gh-142554: avoid divmod crashes due to bad _pylong.int_divmod (GH-142673) (#142697)
gh-142554: avoid `divmod` crashes due to bad `_pylong.int_divmod` (#142673)

(cherry picked from commit 4e4163676a)
2025-12-14 09:03:14 +00:00
dr-carlos
d768900ca4
[3.13] gh-141732: Fix ExceptionGroup repr changing when original exception sequence is mutated (GH-141736) (#142391)
* [3.13] gh-141732: Fix `ExceptionGroup` repr changing when original exception sequence is mutated (GH-141736)
(cherry picked from commit ff2577f56e)

Co-authored-by: dr-carlos <77367421+dr-carlos@users.noreply.github.com>
2025-12-08 18:46:55 +00:00
Sam Gross
1a75c0fb05
[3.13] gh-142218: Fix split table dictionary crash (gh-142229) (gh-142245)
This fixes a regression introduced in gh-140558. The interpreter would
crash if we inserted a non `str` key into a split table that matches an
existing key.
(cherry picked from commit 547d8daf78)
2025-12-04 07:46:24 +00:00
Sergey Miryanov
cbeada9ec7
[3.13] GH-141312: Allow only integers to longrangeiter_setstate state (GH-141317) (GH-141568)
This fixes an assertion error when the new computed start is not an integer.
(cherry picked from commit 10bec7c1eb)
2025-11-15 21:14:17 +02:00
Stan Ulbrych
f1a93727c4
[3.13] gh-140939: Fix memory leak in _PyBytes_FormatEx error path (GH-140957) (#141155)
(cherry picked from commit d6c89a2df2)
2025-11-06 16:16:43 +00:00
Victor Stinner
43882c7c4e
[3.13] gh-140815: Fix faulthandler for invalid/freed frame (#140921) (#140985)
gh-140815: Fix faulthandler for invalid/freed frame (#140921)

faulthandler now detects if a frame or a code object is invalid or
freed.

Add helper functions:

* _PyCode_SafeAddr2Line()
* _PyFrame_SafeGetCode()
* _PyFrame_SafeGetLasti()

_PyMem_IsPtrFreed() now detects pointers in [-0xff, 0xff] range
as freed.

(cherry picked from commit a84181c31b)
2025-11-05 18:39:28 +01:00
Mikhail Efimov
eec9257aa5
[3.13] gh-140551: Fix dict crash if clear is called at lookup stage (GH-140558) (#140744)
* gh-140551: Fix `dict` crash if `clear` is called at `lookup` stage (#140558)

Co-authored-by: Inada Naoki <songofacandy@gmail.com>
2025-10-30 22:36:49 +05:30
Miss Islington (bot)
30c2661b6e
[3.13] gh-132835: Add defensive NULL checks to MRO resolution (GH-134763) (GH-140437)
Currently, there are a few places where tp_mro could theoretically
become NULL, but do not in practice. This commit adds defensive checks for
NULL values to ensure that any changes do not introduce a crash and that
state invariants are upheld.

The assertions added in this commit are all instances where a NULL value would get passed to something not expecting a NULL, so it is better to catch an assertion failure than crash later on.

There are a few cases where it is OK for the return of lookup_tp_mro to be NULL, such as when passed to is_subtype_with_mro, which handles this explicitly.
(cherry picked from commit a8edca62fc)

Co-authored-by: Emma Smith <emma@emmatyping.dev>
2025-10-21 20:44:42 -07:00
Peter Bierma
69230d1c56
[3.13] gh-140406: Fix memory leak upon __hash__ returning a non-integer (GH-140411) (GH-140441)
* gh-140406: Fix memory leak upon `__hash__` returning a non-integer (GH-140411)

(cherry picked from commit 71db05a12d)
2025-10-22 01:07:32 +00:00
Miss Islington (bot)
7992a29512
[3.13] GH-140058: Clear key and value if PyTuple_New fails in dictiter_iternextitem (GH-140059) (#140108)
GH-140058: Clear key and value if `PyTuple_New` fails in `dictiter_iternextitem` (GH-140059)
(cherry picked from commit ded59f7e8e)

Co-authored-by: Sergey Miryanov <sergey.miryanov@gmail.com>
2025-10-14 13:40:13 +00:00
Mikhail Efimov
cbcee9a0f0
[3.13] gh-140000: Traverse name attribute for TypeVar, TypeVarTuple, TypeAliasType, ParamSpec (GH-140016) (#140073)
Correct traversing name attribute for TypeVar, TypeVarTuple, TypeAliasType, ParamSpec
2025-10-13 20:02:32 -07:00
Miss Islington (bot)
2fd8f036c0
[3.13] gh-138902: Fix generator send arg name (GH-138905) (#138913)
gh-138902: Fix generator send arg name (GH-138905)
(cherry picked from commit cb07bd24ee)

Co-authored-by: Marat Khagazheev <marathagazeev@gmail.com>
Co-authored-by: marat <khagazheev@artlebedev.ru>
2025-09-15 11:35:22 +00:00
Stan Ulbrych
0b302280af
[3.13] gh-71648: Optimize PNG files (GH-138842) (#138852)
* Only keep > 1 kb savings
(cherry picked from commit 2e8f64c931)
2025-09-14 08:29:59 -07:00
Miss Islington (bot)
a9020589de
[3.13] gh-71810: Fix _PyLong_AsByteArray() undefined behavior (GH-138873) (#138884)
gh-71810: Fix _PyLong_AsByteArray() undefined behavior (GH-138873)

Don't read p[-1] when p is an empty string: when n==0.
(cherry picked from commit 8b5ce31c2b)

Co-authored-by: Victor Stinner <vstinner@python.org>
2025-09-14 09:49:23 +00:00
Peter Bierma
e7720612ea
[3.13] gh-138479: Ensure that __typing_subst__ returns a tuple (GH-138482) (GH-138786)
* gh-138479: Ensure that `__typing_subst__` returns a tuple (GH-138482)

Raise an exception if __typing_subst__ returns a non-tuple object.

(cherry picked from commit 1da989be74)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
2025-09-11 11:08:57 +00:00
Miss Islington (bot)
7195d7f3d4
[3.13] gh-71810: Fix corner case (length==0) for int.to_bytes() (GH-138739) (#138783)
gh-71810: Fix corner case (length==0) for int.to_bytes() (GH-138739)

```pycon
>>> (0).to_bytes(0, 'big', signed=True)
b''
>>> (-1).to_bytes(0, 'big', signed=True)  # was b''
Traceback (most recent call last):
  File "<python-input-0>", line 1, in <module>
    (-1).to_bytes(0, 'big', signed=True)
    ~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
OverflowError: int too big to convert
```
(cherry picked from commit 011179a79a)

Co-authored-by: Sergey B Kirpichev <skirpichev@gmail.com>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
2025-09-11 10:53:27 +00:00
sobolevn
d3b6bb1125
[3.13] gh-105487: Fix __dir__ entries of GenericAlias (GH-138578) (#138640)
(cherry picked from commit b0420b505e)

Co-authored-by: Emma Smith <emma@emmatyping.dev>
2025-09-08 10:03:03 +00:00
Miss Islington (bot)
f0756f8fa1
[3.13] gh-138516: fix typo in OrderedDict exception msg (GH-138517) (#138522)
gh-138516: fix typo in OrderedDict exception msg (GH-138517)
(cherry picked from commit e9c2a357fb)

Co-authored-by: asas1asas200 <asas1asas200@gmail.com>
2025-09-05 07:19:43 +00:00
Miss Islington (bot)
f2d6931656
[3.13] gh-58124: Avoid CP_UTF8 in UnicodeDecodeError (GH-137415) (#137461)
gh-58124: Avoid CP_UTF8 in UnicodeDecodeError (GH-137415)

Fix name of the Python encoding in Unicode errors of the code page
codec: use "cp65000" and "cp65001" instead of "CP_UTF7" and "CP_UTF8"
which are not valid Python code names.
(cherry picked from commit ce1b747ff6)

Co-authored-by: Victor Stinner <vstinner@python.org>
2025-08-06 12:59:11 +00:00
Neil Schemenauer
5c16f699d2
[3.13] GH-133136: Revise QSBR to reduce excess memory held (gh-135473) (gh-136480)
The free threading build uses QSBR to delay the freeing of dictionary
keys and list arrays when the objects are accessed by multiple threads
in order to allow concurrent reads to proceed with holding the object
lock. The requests are processed in batches to reduce execution
overhead, but for large memory blocks this can lead to excess memory
usage.

Take into account the size of the memory block when deciding when to
process QSBR requests.

Also track the amount of memory being held by QSBR for mimalloc pages.
Advance the write sequence if this memory exceeds a limit.  Advancing
the sequence will allow it to be freed more quickly.

Process the held QSBR items from the "eval breaker", rather than from
`_PyMem_FreeDelayed()`.  This gives a higher chance that the global read
sequence has advanced enough so that items can be freed.

(cherry picked from commit 113de8545f)

Co-authored-by: Neil Schemenauer <nas-github@arctrix.com>
Co-authored-by: Sam Gross <colesbury@gmail.com>
2025-07-30 11:06:44 -07:00
Duane Griffin
2383c6015c
[3.13] gh-127971: fix off-by-one read beyond the end of a string during search (#132574) (#136648)
(cherry picked from commit 85ec3b3b50)
2025-07-14 11:50:22 +02:00
Kumar Aditya
823bf76d37
[3.13] gh-109700: fix memory error handling in PyDict_SetDefault (#136338) (#136642)
gh-109700: fix memory error handling in `PyDict_SetDefault` (#136338)

(cherry picked from commit d22e073d2b)
2025-07-14 08:25:31 +00:00
Bénédikt Tran
360540fd47
[3.13] gh-91153: prevent a crash in bytearray.__setitem__(ind, ...) when ind.__index__ has side-effects (GH-132379) (#136582)
(cherry picked from commit 5e1e21dee3)

Co-authored-by: Bast <52266665+bast0006@users.noreply.github.com>
2025-07-12 16:34:45 +02:00
Victor Stinner
e3a277c8d8
[3.13] gh-135607: remove null checking of weakref list in dealloc of extension modules and objects (#135614) (#136126)
gh-135607: remove null checking of weakref list in dealloc of extension modules and objects (#135614)

(cherry picked from commit b1056c2a44)

Co-authored-by: Xuanteng Huang <44627253+xuantengh@users.noreply.github.com>
Co-authored-by: Kumar Aditya <kumaraditya@python.org>
2025-07-01 11:26:52 +02:00
Serhiy Storchaka
3576e1a954
[3.13] gh-78465: Fix error message for cls.__new__(cls, ...) where cls is not instantiable (GH-135981) (GH-136031)
Previous error message suggested to use cls.__new__(), which
obviously does not work. Now the error message is the same as for
cls(...).
(cherry picked from commit c45f4f3ebe)
2025-06-27 12:07:22 +00:00
Miss Islington (bot)
469f69d4e2
[3.13] gh-135878: Fix crash in types.SimpleNamespace.__repr__ (GH-135889) (#135895)
gh-135878: Fix crash in `types.SimpleNamespace.__repr__` (GH-135889)
(cherry picked from commit b3ab94acd3)

Co-authored-by: sobolevn <mail@sobolevn.me>
Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
2025-06-24 16:59:29 +00:00
Sam Gross
f33a5e891a
[3.13] gh-132617: Fix dict.update() mutation check (gh-134815) (gh-135582)
Use `ma_used` instead of `ma_keys->dk_nentries` for modification check
so that we only check if the dictionary is modified, not if new keys are
added to a different dictionary that shared the same keys object.
(cherry picked from commit d8994b0a77)
2025-06-16 17:30:52 +00:00
Mikhail Efimov
e753a7c5f0
[3.13] gh-125723: Fix crash with f_locals when generator frame outlive their generator (GH-135453)
Backport of 8e20e42cc6 from GH-126956

Closes GH-125723
2025-06-14 04:08:03 +10:00
Serhiy Storchaka
3e1b8d6e67
[3.13] gh-133489: Remove size restrictions on getrandbits() and randbytes() (GH-133658) (GH-134965)
random.getrandbits() can now generate more that 2**31 bits.
random.randbytes() can now generate more that 256 MiB.
(cherry picked from commit 68784fed78)
2025-06-02 23:16:30 +03:00
Serhiy Storchaka
6279eb8c07
[3.13] gh-133767: Fix use-after-free in the unicode-escape decoder with an error handler (GH-129648) (GH-133944)
If the error handler is used, a new bytes object is created to set as
the object attribute of UnicodeDecodeError, and that bytes object then
replaces the original data. A pointer to the decoded data will became invalid
after destroying that temporary bytes object. So we need other way to return
the first invalid escape from _PyUnicode_DecodeUnicodeEscapeInternal().

_PyBytes_DecodeEscape() does not have such issue, because it does not
use the error handlers registry, but it should be changed for compatibility
with _PyUnicode_DecodeUnicodeEscapeInternal().
(cherry picked from commit 9f69a58623)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
2025-05-20 14:46:57 +02:00
Sam Gross
e1cc789531
gh-132869: Fix crash in _PyObject_TryGetInstanceAttribute (#133700)
This fixes a crash in `_PyObject_TryGetInstanceAttribute` due to the use
of `_PyDictKeys_StringLookup` on an unlocked dictionary that may be
concurrently modified.

The underlying bug was already fixed in 3.14 and the main branch.

(partially cherry picked from commit 1b15c89a17)
2025-05-14 12:47:34 +09:00
Brandt Bucher
50b45c4f45
[3.13] GH-133543: Maintain tracking for materialized instance dictionaries (GH-133617) 2025-05-12 13:00:01 -07:00
Inada Naoki
f0a88e2ce5
gh-133703: dict: fix calculate_log2_keysize() (GH-133809)
(cherry picked from commit 92337f666e)
2025-05-11 15:14:11 +09:00
Sam Gross
6ab4a4a32c
[3.13] gh-132762: Fix underallocation bug in dict.fromkeys()(gh-133627) (gh-133686)
The function `dict_set_fromkeys()` adds elements of a set to an existing
dictionary. The size of the expanded dictionary was estimated with
`PySet_GET_SIZE(iterable)`, which did not take into account the size of the
existing dictionary.
(cherry picked from commit 421ba589d0)

Co-authored-by: Angela Liss <59097311+angela-tarantula@users.noreply.github.com>
2025-05-08 17:40:05 +00:00
Donghee Na
7ffef8d07b
[3.13] gh-132070: Use _PyObject_IsUniquelyReferenced in unicodeobject (gh-133039) (gh-133126)
* gh-132070: Use _PyObject_IsUniquelyReferenced in unicodeobject (gh-133039)

---------
(cherry picked from commit 75cbb8d89e)

Co-authored-by: Donghee Na <donghee.na@python.org>
Co-authored-by: Kumar Aditya <kumaraditya@python.org>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

* Add _PyObject_IsUniquelyReferenced

---------

Co-authored-by: Kumar Aditya <kumaraditya@python.org>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
2025-04-29 14:26:44 +09:00
Neil Schemenauer
ca46ec85f8
[3.13] gh-132942: Fix races in type lookup cache (gh-133114)
Two races related to the type lookup cache, when used in the
free-threaded build.  This caused test_opcache to sometimes fail (as
well as other hard to re-produce failures).
2025-04-28 22:08:09 +00:00
Miss Islington (bot)
341b86e095
[3.13] gh-132713: Fix typing.Union[index] race condition (GH-132802) (#132839)
gh-132713: Fix typing.Union[index] race condition (GH-132802)

Add union_init_parameters() helper function. Use a critical section
to initialize the 'parameters' member.
(cherry picked from commit dc3e9638c2)

Co-authored-by: Victor Stinner <vstinner@python.org>
2025-04-23 14:12:03 +00:00
Victor Stinner
3de0f55f34
[3.13] gh-132713: Fix repr(list) race condition (#132801) (#132809)
Hold a strong reference to the item while calling repr(item).

(cherry picked from commit a4ea80d523)
2025-04-23 15:44:33 +02:00
Peter Bierma
bb59fdec71
[3.13] gh-132747: Fix NULL dereference when calling a method's __get__ manually (GH-132772) (#132786)
(cherry picked from commit fa70bf8593)

Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
2025-04-21 21:38:51 +00:00
Miss Islington (bot)
6d48194d9f
[3.13] gh-132176: Fix crash on type() when tuple subclass passed as bases (GH-132212) (#132548)
gh-132176: Fix crash on `type()` when `tuple` subclass passed as `bases` (GH-132212)
(cherry picked from commit b6c552f9e6)

Co-authored-by: sobolevn <mail@sobolevn.me>
Co-authored-by: Victor Stinner <vstinner@python.org>
2025-04-15 11:38:20 +00:00
Kumar Aditya
67b1c765ef
[3.13] gh-132213: use relaxed atomics for set hash (#132447) 2025-04-12 18:20:24 +00:00
Mark Shannon
3f3863281b
[3.13] GH-127953: Make line number lookup O(1) regardless of the size of the code object (#129127)
GH-127953: Make line number lookup O(1) regardless of the size of the code object (GH-128350)
2025-04-07 20:15:02 +02:00