Thanks to visit codestin.com
Credit goes to github.com

Skip to content

ctypes: crash when deleting Pointer.contents on the free-threaded build #156124

Description

@serhiy-storchaka

Crash report

del ptr.contents crashes the free-threaded build.

>>> from ctypes import POINTER, c_int
>>> ptr = POINTER(c_int)(c_int(42))
>>> del ptr.contents
Segmentation fault

Pointer_set_contents() passes the new value to Py_BEGIN_CRITICAL_SECTION2(), which dereferences it to get the mutex, but the value is NULL when the attribute is deleted. The check for NULL is in Pointer_set_contents_lock_held(), which is only called after the critical section is entered.

With the GIL it raises TypeError: Pointer does not support item deletion.

The critical section was added in gh-128182, so this affects 3.14 and newer.

Linked PRs

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.14bugs and security fixes3.15pre-release feature fixes, bugs and security fixes3.16new features, bugs and security fixesextension-modulesC modules in the Modules dirtopic-free-threadingtype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions