Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Abort in _interpqueuesmodule due to queue being created with negative maxsize #135698

Open
@devdanzin

Description

@devdanzin

Crash report

What happened?

The interpreter will abort when running the following MRE, which creates a queue with maxsize=-1:

import _interpqueues

_interpqueues.create(-1, 1, 1)
_interpqueues.is_full(1)

Abort backtrace:

python: ./Modules/_interpqueuesmodule.c:713: _queue_is_full: Assertion `queue->items.count <= queue->items.maxsize' failed.

Program received signal SIGABRT, Aborted.

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=140737350575936) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=6, threadid=140737350575936) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=140737350575936, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x00007ffff7cdf476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff7cc57f3 in __GI_abort () at ./stdlib/abort.c:79
#5  0x00007ffff7cc571b in __assert_fail_base (fmt=0x7ffff7e7a130 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n",
    assertion=0x7ffff79dc020 "queue->items.count <= queue->items.maxsize", file=0x7ffff79dc000 "./Modules/_interpqueuesmodule.c", line=713,
    function=<optimized out>) at ./assert/assert.c:94
#6  0x00007ffff7cd6e96 in __GI___assert_fail (assertion=assertion@entry=0x7ffff79dc020 "queue->items.count <= queue->items.maxsize",
    file=file@entry=0x7ffff79dc000 "./Modules/_interpqueuesmodule.c", line=line@entry=713,
    function=function@entry=0x7ffff79dc980 <__PRETTY_FUNCTION__.16> "_queue_is_full") at ./assert/assert.c:103
#7  0x00007ffff79d7aed in _queue_is_full (queue=0x555555de5fa0, p_is_full=p_is_full@entry=0x7fffffffd33c) at ./Modules/_interpqueuesmodule.c:713
#8  0x00007ffff79d7cde in queue_is_full (queues=queues@entry=0x7ffff79e05a8 <_globals+8>, qid=qid@entry=1,
    p_is_full=p_is_full@entry=0x7fffffffd33c) at ./Modules/_interpqueuesmodule.c:1248
#9  0x00007ffff79da801 in queuesmod_is_full (self=0x7ffff7ac8590, args=args@entry=0x7ffff7a5bde0, kwds=kwds@entry=0x0)
    at ./Modules/_interpqueuesmodule.c:1803
#10 0x000055555570b67d in cfunction_call (func=0x7ffff7ac8ad0, args=0x7ffff7a5bde0, kwargs=0x0) at Objects/methodobject.c:565
#11 0x0000555555689bf1 in _PyObject_MakeTpCall (tstate=tstate@entry=0x555555d6f7c0 <_PyRuntime+331232>, callable=callable@entry=0x7ffff7ac8ad0,
    args=args@entry=0x7fffffffd668, nargs=<optimized out>, keywords=keywords@entry=0x0) at Objects/call.c:242
#12 0x000055555568a012 in _PyObject_VectorcallTstate (tstate=0x555555d6f7c0 <_PyRuntime+331232>, callable=0x7ffff7ac8ad0, args=0x7fffffffd668,
    nargsf=<optimized out>, kwnames=0x0) at ./Include/internal/pycore_call.h:167
#13 0x000055555568a03e in PyObject_Vectorcall (callable=callable@entry=0x7ffff7ac8ad0, args=args@entry=0x7fffffffd668, nargsf=<optimized out>,
    kwnames=kwnames@entry=0x0) at Objects/call.c:327

Found using fusil by @vstinner.

CPython versions tested on:

CPython main branch, 3.15, 3.14

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.15.0a0 (heads/main-dirty:b706ff003c5, Jun 14 2025, 23:08:39) [GCC 11.4.0]

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    extension-modulesC modules in the Modules dirtype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions