gh-142557: fix UAF in `bytearray.__mod__` when object is mutated while formatting `%`-style arguments (GH-143213)
(cherry picked from commit 61ee04834b)
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
gh-142560: prevent use-after-free in search-like methods by exporting buffer in bytearray (GH-142938)
(cherry picked from commit 220f0b1077)
Co-authored-by: wangxiaolei <fatelei@gmail.com>
gh-142554: avoid `divmod` crashes due to bad `_pylong.int_divmod` (GH-142673)
(cherry picked from commit 4e4163676a)
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
There are places we use "relaxed" loads where C11 requires "consume" or
stronger. Unfortunately, compilers don't really implement "consume" so
fake it for our use in a way that avoids upsetting TSan.
(cherry picked from commit 0a62f8277e)
Co-authored-by: Sam Gross <colesbury@gmail.com>
gh-142433: Move deref to below the error when checking for laststring (GH-142402)
Move deref of laststring to below the error checking so the deref
is applied after the object in strings is replaced.
(cherry picked from commit 785268fdce)
Co-authored-by: AZero13 <gfunni234@gmail.com>
This fixes a regression introduced in gh-140558. The interpreter would
crash if we inserted a non `str` key into a split table that matches an
existing key.
(cherry picked from commit 547d8daf78)
Co-authored-by: Sam Gross <colesbury@gmail.com>
The dataclasses `__init__` function is generated dynamically by a call to `exec()` and so doesn't have deferred reference counting enabled. Enable deferred reference counting on functions when assigned as an attribute to type objects to avoid reference count contention when creating dataclass instances.
(cherry picked from commit ce79154176)
Co-authored-by: Edward Xu <xuxiangad@gmail.com>
This fixes an assertion error when the new computed start is not an integer.
(cherry picked from commit 10bec7c1eb)
Co-authored-by: Sergey Miryanov <sergey.miryanov@gmail.com>
gh-140815: Fix faulthandler for invalid/freed frame (GH-140921)
faulthandler now detects if a frame or a code object is invalid or
freed.
Add helper functions:
* _PyCode_SafeAddr2Line()
* _PyFrame_SafeGetCode()
* _PyFrame_SafeGetLasti()
_PyMem_IsPtrFreed() now detects pointers in [-0xff, 0xff] range
as freed.
(cherry picked from commit a84181c31b)
Co-authored-by: Victor Stinner <vstinner@python.org>
gh-140348: Fix using | on unusual objects plus Unions (GH-140383)
(cherry picked from commit 7a9437d986)
Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com>
Remove dead stores to 'size' in UTF-8 decoder (unicodeobject.c) (GH-140637)
(cherry picked from commit 7d70a147f5)
Co-authored-by: Shamil <ashm.tech@proton.me>
The `make_gen()` function creates and tracks generator/coro objects, but
doesn't fully initialize all the fields. At a minimum, we need to
initialize all the fields that may be accessed by gen_traverse because
the call to `compute_cr_origin()` can trigger a GC.
(cherry picked from commit 574405c19e)
Co-authored-by: Sam Gross <colesbury@gmail.com>
* Count number of actually tracked objects, instead of trackable objects. This ensures that untracking tuples has the desired effect of reducing GC overhead
* Do not track most untrackable tuples during creation. This prevents large numbers of small tuples causing execessive GCs.
Currently, there are a few places where tp_mro could theoretically
become NULL, but do not in practice. This commit adds defensive checks for
NULL values to ensure that any changes do not introduce a crash and that
state invariants are upheld.
The assertions added in this commit are all instances where a NULL value would get passed to something not expecting a NULL, so it is better to catch an assertion failure than crash later on.
There are a few cases where it is OK for the return of lookup_tp_mro to be NULL, such as when passed to is_subtype_with_mro, which handles this explicitly.
(cherry picked from commit a8edca62fc)
Co-authored-by: Emma Smith <emma@emmatyping.dev>
gh-140406: Fix memory leak upon `__hash__` returning a non-integer (GH-140411)
(cherry picked from commit 71db05a12d)
Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
The previous `Py_REFCNT(x) == 1` checks can have data races in the free
threaded build. `_PyObject_IsUniquelyReferenced(x)` is a more conservative
check that is safe in the free threaded build and is identical to
`Py_REFCNT(x) == 1` in the default GIL-enabled build.
(cherry picked from commit 32c264982e)
Co-authored-by: Sergey Miryanov <sergey.miryanov@gmail.com>
GH-140058: Clear key and value if `PyTuple_New` fails in `dictiter_iternextitem` (GH-140059)
(cherry picked from commit ded59f7e8e)
Co-authored-by: Sergey Miryanov <sergey.miryanov@gmail.com>
gh-139988: fix a leak when failing to create a Union type (GH-139990)
(cherry picked from commit 6710156bd2)
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
gh-133467: fix data race in `type_set_name` (GH-137302)
Fix data race in `type_set_name` by assigning name under stop the world pause making it thread safe in free-threading.
(cherry picked from commit e99bc7fd44)
Co-authored-by: Kumar Aditya <kumaraditya@python.org>
gh-58124: Avoid CP_UTF8 in UnicodeDecodeError (GH-137415)
Fix name of the Python encoding in Unicode errors of the code page
codec: use "cp65000" and "cp65001" instead of "CP_UTF7" and "CP_UTF8"
which are not valid Python code names.
(cherry picked from commit ce1b747ff6)
Co-authored-by: Victor Stinner <vstinner@python.org>
gh-71810: Fix _PyLong_AsByteArray() undefined behavior (GH-138873)
Don't read p[-1] when p is an empty string: when n==0.
(cherry picked from commit 8b5ce31c2b)
Co-authored-by: Victor Stinner <vstinner@python.org>
Replacing the slot isn't thread-safe if the GIL is disabled. Don't
require that the slot has been replaced when specializing.
(cherry picked from commit 485b16b4f7)
Previously, we assumed that instrumentation would happen for all copies of
the bytecode if the instrumentation version on the code object didn't match
the per-interpreter instrumentation version. That assumption was incorrect:
instrumentation will exit early if there are no new "events," even if there
is an instrumentation version mismatch.
To fix this, include the instrumented opcodes when creating new copies of
the bytecode, rather than replacing them with their uninstrumented variants.
I don't think we have to worry about races between instrumentation and creating
new copies of the bytecode: instrumentation and new bytecode creation cannot happen
concurrently. Instrumentation requires that either the world is stopped or the
code object's per-object lock is held and new bytecode creation requires holding
the code object's per-object lock.
(cherry picked from commit d995922198)
Co-authored-by: mpage <mpage@meta.com>
Co-authored-by: Kumar Aditya <kumaraditya@python.org>
gh-127971: fix off-by-one read beyond the end of a string during search (GH-132574)
(cherry picked from commit 85ec3b3b50)
Co-authored-by: Duane Griffin <duaneg@dghda.com>
