Skip to content

codeobject.c: co_tlbc NULL deref + replacement_locations leak #150546

@lpyu001

Description

@lpyu001

Bug report

Bug description:

Bug report

Bug description:

Summary

1.code_dealloc (line 2550, Py_GIL_DISABLED only): co->co_tlbc->size accessed without NULL check when init_code fails on _PyCodeArray_New → segfault.
2._PyCode_New (line 741-743): replacement_locations not DECREF'd when init_code fails.

This is a sub-issue of #146102 with gist details

CPython versions tested on:

CPython main branch

Operating systems tested on:

Windows

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    type-bugAn unexpected behavior, bug, or error
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions