Thanks to visit codestin.com
Credit goes to github.com

Skip to content

gh-142555: Fix null pointer dereference in array.__setitem__ via re-entrant __index__ #142713

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
encukou merged 22 commits into from
Feb 2, 2026
Merged

gh-142555: Fix null pointer dereference in array.__setitem__ via re-entrant __index__ #142713

Changes from 1 commit
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
71fc725
Fix null pointer dereference in array.__setitem__ via re-entrant __in…
aisk Dec 14, 2025
6c437d5
Update Misc/NEWS.d/next/Core_and_Builtins/2025-12-15-02-02-45.gh-issu…
aisk Dec 15, 2025
e3c728a
Move the news entry to library folder
aisk Dec 15, 2025
67e98b5
Also check if the ob_item's size is changed by user's code
aisk Dec 17, 2025
ad18d48
Add check on more *_setitem methods
aisk Dec 17, 2025
c408c57
Check other setitem methods
aisk Dec 18, 2025
95e4eec
Reduce the comments
aisk Dec 18, 2025
fc6f987
Re-order the test
aisk Dec 18, 2025
c8cbd28
Refactor the array check codes to a function
aisk Dec 19, 2025
0b3db3c
Change the bound check from function to macro
aisk Dec 20, 2025
8eeba89
Revert the format changed made by IDE automatically
aisk Dec 20, 2025
e00b7a4
Revert more format changes
aisk Dec 20, 2025
2b6d5dc
Revert more format changes
aisk Dec 20, 2025
c83b64a
Revert more format test
aisk Dec 20, 2025
d0ff678
Update news entry
aisk Dec 20, 2025
e865d0d
Update Misc/NEWS.d/next/Library/2025-12-15-02-02-45.gh-issue-142555.E…
aisk Dec 27, 2025
0ad0f28
Refactor tests
aisk Dec 27, 2025
b3617c8
Format the macro by PEP7
aisk Dec 27, 2025
deccbf0
Update by review comments
aisk Dec 27, 2025
a4dab68
Simplify the test
aisk Dec 27, 2025
1befa98
Update comment
aisk Dec 27, 2025
37ed8f8
Update Lib/test/test_array.py
aisk Dec 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Reduce the comments
  • Loading branch information
@aisk
aisk committed Dec 18, 2025
commit 95e4eec1792ca556a649a05729435ffba5a94fee
51 changes: 12 additions & 39 deletions Modules/arraymodule.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -222,9 +222,7 @@ b_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
if (!PyArg_Parse(v, "h;array item must be integer", &x))
return -1;

/* Check buffer validity and bounds after PyArg_Parse which may call user-defined
* __index__ on v, which might modify the array buffer. See gh-142555.
*/
// Check buffer validity and bounds after call user-defined method.
if (i >= 0 && (ap->ob_item == NULL || i >= Py_SIZE(ap))) {
PyErr_SetString(PyExc_IndexError,
"array assignment index out of range");
Expand Down Expand Up @@ -261,9 +259,7 @@ BB_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
if (!PyArg_Parse(v, "b;array item must be integer", &x))
return -1;

/* Check buffer validity and bounds after PyArg_Parse which may call user-defined
* __index__ on v, which might modify the array buffer. See gh-142555.
*/
// Check buffer validity and bounds after call user-defined method.
if (i >= 0 && (ap->ob_item == NULL || i >= Py_SIZE(ap))) {
PyErr_SetString(PyExc_IndexError,
"array assignment index out of range");
Expand Down Expand Up @@ -363,9 +359,7 @@ h_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
if (!PyArg_Parse(v, "h;array item must be integer", &x))
return -1;

/* Check buffer validity and bounds after PyArg_Parse which may call user-defined
* __index__ on v, which might modify the array buffer. See gh-142555.
*/
// Check buffer validity and bounds after call user-defined method.
if (i >= 0 && (ap->ob_item == NULL || i >= Py_SIZE(ap))) {
PyErr_SetString(PyExc_IndexError,
"array assignment index out of range");
Expand Down Expand Up @@ -402,9 +396,7 @@ HH_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
return -1;
}

/* Check buffer validity and bounds after PyArg_Parse which may call user-defined
* __index__ on v, which might modify the array buffer. See gh-142555.
*/
// Check buffer validity and bounds after call user-defined method.
if (i >= 0 && (ap->ob_item == NULL || i >= Py_SIZE(ap))) {
PyErr_SetString(PyExc_IndexError,
"array assignment index out of range");
Expand All @@ -430,9 +422,7 @@ i_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
if (!PyArg_Parse(v, "i;array item must be integer", &x))
return -1;

/* Check buffer validity and bounds after PyArg_Parse which may call user-defined
* __index__ on v, which might modify the array buffer. See gh-142555.
*/
// Check buffer validity and bounds after call user-defined method.
if (i >= 0 && (ap->ob_item == NULL || i >= Py_SIZE(ap))) {
PyErr_SetString(PyExc_IndexError,
"array assignment index out of range");
Expand Down Expand Up @@ -480,10 +470,7 @@ II_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
return -1;
}

/* Check buffer validity and bounds after potential user code calls
* (_PyNumber_Index and PyLong_AsUnsignedLong may modify the array buffer).
* See gh-142555.
*/
// Check buffer validity and bounds after call user-defined method.
if (i >= 0 && (ap->ob_item == NULL || i >= Py_SIZE(ap))) {
PyErr_SetString(PyExc_IndexError,
"array assignment index out of range");
Expand Down Expand Up @@ -515,9 +502,7 @@ l_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
if (!PyArg_Parse(v, "l;array item must be integer", &x))
return -1;

/* Check buffer validity and bounds after PyArg_Parse which may call user-defined
* __index__ on v, which might modify the array buffer. See gh-142555.
*/
// Check buffer validity and bounds after call user-defined method.
if (i >= 0 && (ap->ob_item == NULL || i >= Py_SIZE(ap))) {
PyErr_SetString(PyExc_IndexError,
"array assignment index out of range");
Expand Down Expand Up @@ -556,10 +541,7 @@ LL_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
return -1;
}

/* Check buffer validity and bounds after potential user code calls
* (_PyNumber_Index and PyLong_AsUnsignedLong may modify the array buffer).
* See gh-142555.
*/
// Check buffer validity and bounds after call user-defined method.
if (i >= 0 && (ap->ob_item == NULL || i >= Py_SIZE(ap))) {
PyErr_SetString(PyExc_IndexError,
"array assignment index out of range");
Expand Down Expand Up @@ -591,9 +573,7 @@ q_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
if (!PyArg_Parse(v, "L;array item must be integer", &x))
return -1;

/* Check buffer validity and bounds after PyArg_Parse which may call user-defined
* __index__ on v, which might modify the array buffer. See gh-142555.
*/
// Check buffer validity and bounds after call user-defined method.
if (i >= 0 && (ap->ob_item == NULL || i >= Py_SIZE(ap))) {
PyErr_SetString(PyExc_IndexError,
"array assignment index out of range");
Expand Down Expand Up @@ -633,10 +613,7 @@ QQ_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
return -1;
}

/* Check buffer validity and bounds after potential user code calls
* (_PyNumber_Index and PyLong_AsUnsignedLongLong may modify the array buffer).
* See gh-142555.
*/
// Check buffer validity and bounds after call user-defined method.
if (i >= 0 && (ap->ob_item == NULL || i >= Py_SIZE(ap))) {
PyErr_SetString(PyExc_IndexError,
"array assignment index out of range");
Expand Down Expand Up @@ -668,9 +645,7 @@ f_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
if (!PyArg_Parse(v, "f;array item must be float", &x))
return -1;

/* Check buffer validity and bounds after PyArg_Parse which may call user-defined
* __index__ on v, which might modify the array buffer. See gh-142555.
*/
// Check buffer validity and bounds after call user-defined method.
if (i >= 0 && (ap->ob_item == NULL || i >= Py_SIZE(ap))) {
PyErr_SetString(PyExc_IndexError,
"array assignment index out of range");
Expand All @@ -695,9 +670,7 @@ d_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
if (!PyArg_Parse(v, "d;array item must be float", &x))
return -1;

/* Check buffer validity and bounds after PyArg_Parse which may call user-defined
* __index__ on v, which might modify the array buffer. See gh-142555.
*/
// Check buffer validity and bounds after call user-defined method.
if (i >= 0 && (ap->ob_item == NULL || i >= Py_SIZE(ap))) {
PyErr_SetString(PyExc_IndexError,
"array assignment index out of range");
Expand Down
Loading