Repository navigation
NULL pointer dereference in _Py_TYPE_impl with fuzzed code #150146
Description
Crash report
What happened?
Python crashes when running this fuzzed code:
from typing import Mapping, TypeVar
x = memoryview[TypeVar("")]
x[*Mapping[..., ...]]AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x55cc81a1f7cd bp 0x7ffe32df6410 sp 0x7ffe32df6170 T0)
The signal is caused by a READ memory access.
Hint: address points to the zero page.
#0 0x55cc81a1f7cd in _Py_TYPE_impl Include/object.h:234
#1 0x55cc81a1f7cd in _Py_subs_parameters Objects/genericaliasobject.c:423
#2 0x55cc81a27c5d in ga_getitem Objects/genericaliasobject.c:586
#3 0x55cc818c7ed8 in PyObject_GetItem Objects/abstract.c:163
#4 0x55cc821cd7c0 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:65
#5 0x55cc82251d84 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
#6 0x55cc82251d84 in _PyEval_Vector Python/ceval.c:2156
#7 0x55cc82251d84 in PyEval_EvalCode Python/ceval.c:686
#8 0x55cc824dd853 in run_mod Python/pythonrun.c:1472
#9 0x55cc824e7a7b in pyrun_file Python/pythonrun.c:1296
#10 0x55cc824e7a7b in _PyRun_SimpleFileObject Python/pythonrun.c:518
#11 0x55cc824e8cfc in _PyRun_AnyFileObject Python/pythonrun.c:81
#12 0x55cc825e8ac7 in pymain_run_file_obj Modules/main.c:411
#13 0x55cc825e8ac7 in pymain_run_file Modules/main.c:430
#14 0x55cc825e8ac7 in pymain_run_python Modules/main.c:715
#15 0x55cc825ec2bd in Py_RunMain Modules/main.c:796
#16 0x55cc825ec2bd in pymain_main Modules/main.c:826
#17 0x55cc825ec2bd in Py_BytesMain Modules/main.c:850
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Output from running 'python -VV' on the command line:
Python 3.16.0a0 (heads/main:d948eaa3660, May 20 2026, 05:08:21) [GCC 16.1.1 20260430]
Linked PRs
- gh-150146: Fix NULL dereference in
_Py_subs_parameters#150147 - [3.15] gh-150146: Fix NULL dereference in
_Py_subs_parameters(GH-150147) #150153 - [3.14] gh-150146: Fix NULL dereference in
_Py_subs_parameters(GH-150147) #150154 - [3.13] gh-150146: Fix NULL dereference in
_Py_subs_parameters(GH-150147) #150155
Activity
gh-150146: Fix NULL dereference in `_Py_subs_parameters` (#150147)
[3.14] gh-150146: Fix NULL dereference in `_Py_subs_parameters` (GH-1…
[3.15] gh-150146: Fix NULL dereference in `_Py_subs_parameters` (GH-1…
[3.13] gh-150146: Fix NULL dereference in `_Py_subs_parameters` (GH-1…