Skip to content

Using a null pointer in set_tp_mro #131711

@smurav

Description

@smurav

set_tp_mro(type, old_mro, 0);

In the mro_hierarchy function the old_mro variable can get a null value from the mro_internal call. There is a check for NULL. However, in case of errors in the PyTuple_Pack or PyList_Append functions, this null value will be passed to function set_tp_mro.

Next, in the release build, type->tp_mro will simply get the NULL value, but in the debug build, the null pointer will be accessed.
The expression PyTuple_CheckExact(mro) in function set_tp_mro does not check the argument for NULL.

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    interpreter-core(Objects, Python, Grammar, and Parser dirs)type-bugAn unexpected behavior, bug, or error

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions