Skip to content

gh-151763: Fix crash in PyList_New() on allocation failure under low memory - #154019

Merged
Eclips4 merged 9 commits into
python:mainfrom
Abhi210:gh-152125
Nov 10, 2026
Merged

Eclips4 merged 9 commits into
python:mainfrom
Abhi210:gh-152125

Conversation

@Abhi210

@Abhi210 Abhi210 commented Jul 18, 2026

Copy link
Copy Markdown
Contributor

Fixes gh-152125 (one of the OOM-injection fuzzing findings tracked under the gh-151763 umbrella).

Comment thread Objects/listobject.c Outdated
}
else {
op->ob_item = NULL;
Py_SET_SIZE(op, 0);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The following two commands are safe, IIUC.

Suggested change
Py_SET_SIZE(op, 0);
op->allocated = 0;
Py_SET_SIZE(op, size);

Comment thread Objects/listobject.c Outdated

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And then we can remove this Py_SET_SIZE.

Comment thread Objects/listobject.c Resolved
@Abhi210
Abhi210 force-pushed the gh-152125 branch 2 times, most recently from 8480542 to cfee4d2 Compare July 19, 2026 13:36
Comment thread Objects/listobject.c Outdated
else {
op->ob_item = NULL;
Py_SET_SIZE(op, size);
op->allocated = size;

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, main idea to set size here, and set allocated=size before GC track. allocated is a gate which stops readers from reading not initialized memory.

So, I propose something like:

op->ob_item = NULL;
op->allocated = 0;
Py_SET_SIZE(op, size);

// ...
// ...
op->allocated = size;
_PyObject_GC_TRACK(op);

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok! I have made the suggested changes. Thank you

@sergey-miryanov sergey-miryanov left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@sergey-miryanov

Copy link
Copy Markdown
Contributor

Failing test (test_create_connection_local_addr_skip_different_family) seems unrelated to the change.

@Abhi210

Abhi210 commented Oct 24, 2026

Copy link
Copy Markdown
Contributor Author

I will see what the issue is

@Abhi210

Abhi210 commented Oct 24, 2026

Copy link
Copy Markdown
Contributor Author

The above CI failure has already been reported: gh-160334. We can wait for it to be resolved.

@Eclips4
Eclips4 enabled auto-merge (squash) November 10, 2026 22:21
@Eclips4 Eclips4 added needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes labels Nov 10, 2026
@Eclips4
Eclips4 merged commit acab532 into python:main Nov 10, 2026
60 checks passed
@miss-islington-app

Copy link
Copy Markdown

Thanks @Abhi210 for the PR, and @Eclips4 for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14, 3.15.
🐍🍒⛏🤖

@bedevere-app

bedevere-app Bot commented Nov 10, 2026

Copy link
Copy Markdown

GH-161785 is a backport of this pull request to the 3.15 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.15 bugs and security fixes label Nov 10, 2026
@bedevere-app

bedevere-app Bot commented Nov 10, 2026

Copy link
Copy Markdown

GH-161786 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Nov 10, 2026
Eclips4 pushed a commit that referenced this pull request Nov 10, 2026
…er low memory (GH-154019) (#161785)

gh-151763: Fix crash in PyList_New() on allocation failure under low memory (GH-154019)
(cherry picked from commit acab532)

Co-authored-by: Abhishek Tiwari <[email protected]>
Co-authored-by: Sergey Miryanov <[email protected]>
Eclips4 pushed a commit that referenced this pull request Nov 10, 2026
…er low memory (GH-154019) (#161786)

gh-151763: Fix crash in PyList_New() on allocation failure under low memory (GH-154019)
(cherry picked from commit acab532)

Co-authored-by: Abhishek Tiwari <[email protected]>
Co-authored-by: Sergey Miryanov <[email protected]>
orsenthil pushed a commit to orsenthil/cpython that referenced this pull request Nov 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Abort/Segfault: corrupted object freelist in clear_freelist

4 participants