classification
Title: _PyErr_CreateException() must check that the result is an exception (CPython Segfault in 5 lines of code)
Type: crash Stage: patch review
Components: Interpreter Core Versions: Python 3.9, Python 3.8, Python 3.7
process
Status: open Resolution:
Dependencies: Superseder:
Assigned To: Nosy List: christian.heimes, coolreader18, serhiy.storchaka, skrause
Priority: normal Keywords: patch

Created on 2019-12-18 18:45 by skrause, last changed 2020-03-26 00:36 by vstinner.

Pull Requests
URL Status Linked Edit
PR 17658 open coolreader18, 2019-12-19 05:08
Messages (4)
msg358639 - (view) Author: Sebastian Krause (skrause) Date: 2019-12-18 18:45
The following lines trigger a segmentation fault:

class E(BaseException):
    def __new__(cls, *args, **kwargs):
        return cls
def a(): yield
a().throw(E)

Source with a bit more explanation: https://gist.github.com/coolreader18/6dbe0be2ae2192e90e1a809f1624c694 (I'm not the author of that gist, just reporting it here).
msg358640 - (view) Author: Christian Heimes (christian.heimes) * (Python committer) Date: 2019-12-18 18:54
I can reproduce the issue on master:

>>> class E(BaseException):
...     def __new__(cls, *args, **kwargs):
...         return cls
... 
>>> def a(): yield
... 
>>> a().throw(E)

Program received signal SIGSEGV, Segmentation fault.
_Py_DECREF (op=<unknown at remote 0x48>, lineno=541, filename=0x61717f "./Include/object.h") at ./Include/object.h:470
470         if (--op->ob_refcnt != 0) {
(gdb) bt
#0  _Py_DECREF (op=<unknown at remote 0x48>, lineno=541, filename=0x61717f "./Include/object.h") at ./Include/object.h:470
#1  _Py_XDECREF (op=<unknown at remote 0x48>) at ./Include/object.h:541
#2  BaseException_set_tb (self=0x837290, tb=<traceback at remote 0x7fffeaaa2c80>, _unused_ignored=_unused_ignored@entry=0x0) at Objects/exceptions.c:234
#3  0x00000000004335bd in PyException_SetTraceback (self=<optimized out>, tb=<optimized out>) at Objects/exceptions.c:319
#4  0x000000000051b6df in _PyErr_PrintEx (tstate=0x78c7c0, set_sys_last_vars=set_sys_last_vars@entry=1) at Python/pythonrun.c:680
#5  0x000000000051bc1f in PyErr_PrintEx (set_sys_last_vars=set_sys_last_vars@entry=1) at Python/pythonrun.c:763
#6  0x000000000051bc32 in PyErr_Print () at Python/pythonrun.c:769
#7  0x000000000051ca1e in PyRun_InteractiveLoopFlags (fp=fp@entry=0x7ffff7de07e0 <_IO_2_1_stdin_>, filename_str=filename_str@entry=0x617126 "<stdin>", flags=flags@entry=0x7fffffffd7f0) at Python/pythonrun.c:135
#8  0x000000000051d0d0 in PyRun_AnyFileExFlags (fp=0x7ffff7de07e0 <_IO_2_1_stdin_>, filename=filename@entry=0x617126 "<stdin>", closeit=closeit@entry=0, flags=flags@entry=0x7fffffffd7f0) at Python/pythonrun.c:80
#9  0x000000000041deda in pymain_run_stdin (config=config@entry=0x78b0e0, cf=cf@entry=0x7fffffffd7f0) at Modules/main.c:467
#10 0x000000000041ea37 in pymain_run_python (exitcode=exitcode@entry=0x7fffffffd82c) at Modules/main.c:556
#11 0x000000000041ea76 in Py_RunMain () at Modules/main.c:632
#12 0x000000000041eacb in pymain_main (args=args@entry=0x7fffffffd870) at Modules/main.c:662
#13 0x000000000041eb47 in Py_BytesMain (argc=<optimized out>, argv=<optimized out>) at Modules/main.c:686
#14 0x000000000041d6df in main (argc=<optimized out>, argv=<optimized out>) at ./Programs/python.c:16
msg358643 - (view) Author: Serhiy Storchaka (serhiy.storchaka) * (Python committer) Date: 2019-12-18 20:05
Good catch! Since you already investigated the code, do you mind to create a PR which fixes a crash? I think that adding PyExceptionInstance_Check() in _PyErr_CreateException() could fix the issue.
msg358649 - (view) Author: Noah (coolreader18) * Date: 2019-12-18 23:46
I'm not sure if this will actually appear as a message (I just registered for the bug tracker and I'm not sure how it works), but I wrote the gist and I can definitely make a PR.
History
Date User Action Args
2020-03-26 00:36:49vstinnersettitle: CPython Segfault in 5 lines of code -> _PyErr_CreateException() must check that the result is an exception (CPython Segfault in 5 lines of code)
2019-12-19 05:08:21coolreader18setkeywords: + patch
stage: patch review
pull_requests: + pull_request17126
2019-12-18 23:46:43coolreader18setnosy: + coolreader18
messages: + msg358649
2019-12-18 20:05:09serhiy.storchakasetmessages: + msg358643
2019-12-18 19:50:39serhiy.storchakasetnosy: + serhiy.storchaka
2019-12-18 18:54:19christian.heimessetnosy: + christian.heimes

messages: + msg358640
versions: + Python 3.9, - Python 3.6
2019-12-18 18:45:15skrausecreate