gh-125038: Iterator checks are added for some FOR_ITER bytecodes, crash fixed

Lib/test/test_generators.py

@@ -268,6 +268,16 @@ def loop():
         #This should not raise
         loop()
 
+    def test_issue125038(self):
+        def get_generator():
+            g = (x for x in range(10))
+            g.gi_frame.f_locals['.0'] = range(20)
+            return g
+
+        err_msg = "'for' requires an object with __iter__ method, got range"
+        with self.assertRaisesRegex(TypeError, err_msg):
+            l = list(get_generator())
+
 class ExceptionTest(unittest.TestCase):
     # Tests for the issue #23353: check that the currently handled exception
     # is correctly saved/restored in PyEval_EvalFrameEx().

Misc/NEWS.d/next/Core_and_Builtins/2024-10-07-19-26-50.gh-issue-125038.ffSLCz.rst

@@ -0,0 +1,2 @@
+Fix SIGSEGV in genexpr after direct changes on gi_frame.f_locals. Patch by
+Mikhail Efimov.

Python/bytecodes.c

@@ -2806,7 +2806,16 @@ dummy_func(
         replaced op(_FOR_ITER, (iter -- iter, next)) {
             /* before: [iter]; after: [iter, iter()] *or* [] (and jump over END_FOR.) */
             PyObject *iter_o = PyStackRef_AsPyObjectBorrow(iter);
-            PyObject *next_o = (*Py_TYPE(iter_o)->tp_iternext)(iter_o);
+            PyTypeObject *type = Py_TYPE(iter_o);
+            iternextfunc iternext = type->tp_iternext;
+            if (iternext == NULL) {
+                _PyErr_Format(tstate, PyExc_TypeError,
+                              "'for' requires an object with "
+                              "__iter__ method, got %.100s",
+                              type->tp_name);
+                ERROR_NO_POP();
+            }
+            PyObject *next_o = (*iternext)(iter_o);
             if (next_o == NULL) {
                 if (_PyErr_Occurred(tstate)) {
                     int matches = _PyErr_ExceptionMatches(tstate, PyExc_StopIteration);
@@ -2832,7 +2841,16 @@ dummy_func(
         op(_FOR_ITER_TIER_TWO, (iter -- iter, next)) {
             /* before: [iter]; after: [iter, iter()] *or* [] (and jump over END_FOR.) */
             PyObject *iter_o = PyStackRef_AsPyObjectBorrow(iter);
-            PyObject *next_o = (*Py_TYPE(iter_o)->tp_iternext)(iter_o);
+            PyTypeObject *type = Py_TYPE(iter_o);
+            iternextfunc iternext = type->tp_iternext;
+            if (iternext == NULL) {
+                _PyErr_Format(tstate, PyExc_TypeError,
+                              "'for' requires an object with "
+                              "__iter__ method, got %.100s",
+                              type->tp_name);
+                ERROR_NO_POP();
+            }
+            PyObject *next_o = (*iternext)(iter_o);
             if (next_o == NULL) {
                 if (_PyErr_Occurred(tstate)) {
                     int matches = _PyErr_ExceptionMatches(tstate, PyExc_StopIteration);
@@ -2856,7 +2874,16 @@ dummy_func(
             _Py_CODEUNIT *target;
             _PyStackRef iter_stackref = TOP();
             PyObject *iter = PyStackRef_AsPyObjectBorrow(iter_stackref);
-            PyObject *next = (*Py_TYPE(iter)->tp_iternext)(iter);
+            PyTypeObject *type = Py_TYPE(iter);
+            iternextfunc iternext = type->tp_iternext;
+            if (iternext == NULL) {
+                _PyErr_Format(tstate, PyExc_TypeError,
+                              "'for' requires an object with "
+                              "__iter__ method, got %.100s",
+                              type->tp_name);
+                ERROR_NO_POP();
+            }
+            PyObject *next = (*iternext)(iter);
             if (next != NULL) {
                 PUSH(PyStackRef_FromPyObjectSteal(next));
                 target = next_instr;