segfault raising an arbitrary object as an exception

[voidspace]

BPO	11627
Nosy	@birkenfeld, @ncoghlan, @pitrou, @voidspace, @Trundle
Files	issue11627.patch issue11627_2.patch issue11627_3.patch issue11627_py27.patch

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2011-07-15.19:07:03.662>
created_at = <Date 2011-03-21.21:59:21.935>
labels = ['type-crash']
title = 'segfault raising an arbitrary object as an exception'
updated_at = <Date 2011-07-15.19:10:55.670>
user = 'https://github.com/voidspace'

bugs.python.org fields:

activity = <Date 2011-07-15.19:10:55.670>
actor = 'python-dev'
assignee = 'none'
closed = True
closed_date = <Date 2011-07-15.19:07:03.662>
closer = 'python-dev'
components = []
creation = <Date 2011-03-21.21:59:21.935>
creator = 'michael.foord'
dependencies = []
files = ['21328', '21329', '21346', '21347']
hgrepos = []
issue_num = 11627
keywords = ['patch']
message_count = 15.0
messages = ['131687', '131688', '131689', '131690', '131692', '131693', '131694', '131701', '131704', '131716', '131740', '131799', '131842', '140460', '140461']
nosy_count = 7.0
nosy_names = ['georg.brandl', 'ncoghlan', 'pitrou', 'michael.foord', 'Trundle', 'santoso.wijaya', 'python-dev']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue11627'
versions = ['Python 3.2', 'Python 3.3']

[voidspace]

Python 3.2 (r32:88452, Feb 20 2011, 10:19:59) 
[GCC 4.0.1 (Apple Inc. build 5493)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> class Foo(Exception):
...  def __new__(*args):
...   return object()
... 
>>> try:
...  raise Foo
... except Exception as e:
...  print ('got it', e)
... 
Bus error

[voidspace]

Personally I don't think this should be valid at all (it should ideally be an error at the raise point). It is the kind of thing that causes difficulties for the other implementations trying to match CPython behaviour (this code works in Python 2.7 - you can catch the object()).

[pitrou]

Have you tried 3.1?

[voidspace]

This:

raise type('',(Exception,),{'__new__':lambda *a:object()})

Segfaults 3.2 but not 3.1.

[santosowijaya]

Oddly, this works:

C:\Users\santa>C:\python32\python.exe
Python 3.2 (r32:88445, Feb 20 2011, 21:30:00) [MSC v.1500 64 bit (AMD64)] on win
32
Type "help", "copyright", "credits" or "license" for more information.
>>> class Foo(Exception):
...     def __new__(*args):
...             obj = object()
...             print('Returning {}'.format(repr(obj)))
...             return obj
...
>>> try:
...     raise Foo
... except Exception as e:
...     print('Got it: {}'.format(repr(e)))
...
Returning <object object at 0x00000000022D26D0>
Returning <object object at 0x000000000254B8E0>
Got it: <object object at 0x000000000254B8E0>
>>> ^Z

But this does not:

C:\Users\santa>C:\python32\python.exe
Python 3.2 (r32:88445, Feb 20 2011, 21:30:00) [MSC v.1500 64 bit (AMD64)] on win
32
Type "help", "copyright", "credits" or "license" for more information.
>>> class Foo(Exception):
...     def __new__(*args):
...             obj = object()
...             print('Returning', repr(obj))
...             return obj
...
>>> try:
...     raise Foo
... except Exception as e:
...     print('Got it:', repr(e))
...
Returning <object object at 0x00000000022F36D0>
Returning <object object at 0x00000000022F38B0>

crash!

[santosowijaya]

Also, why is the print() in __new__ executed twice?

[Trundle]

On Mon, Mar 21, 2011 at 10:27 PM, Santoso Wijaya <report@bugs.python.org> wrote:

Santoso Wijaya <santoso.wijaya@gmail.com> added the comment:

Also, why is the print() in __new__ executed twice?

Because PyErr_NormalizeException() is called twice: First time when
the exceptions is raised, and then a second time when the exception is
caught. Because the previous call didn't instantiate an instance of a
exception, the second call will (try to) create a new exception
instance.

[Trundle]

Attached is a patch. I'm not too happy about the error message though, I think it's more confusing than helpful.

[pitrou]

Le lundi 21 mars 2011 à 22:57 +0000, Andreas Stührk a écrit :

Andreas Stührk <andy-python@hammerhartes.de> added the comment:

Attached is a patch. I'm not too happy about the error message though,
I think it's more confusing than helpful.

You could try something more explicit, such as
"calling %s() should have returned an instance of BaseException, not %s"
% (type, Py_TYPE(value))

By the way, you have a tab character in your patch. Please only use
spaces for indentation.

[Trundle]

Antoine Pitrou <pitrou@free.fr> added the comment:
You could try something more explicit, such as
"calling %s() should have returned an instance of BaseException, not %s"
% (type, Py_TYPE(value))

Thanks, updated the patch.

By the way, you have a tab character in your patch. Please only use
spaces for indentation.

I am terribly sorry for that. I always realise after the first changed
line that my editor is in the wrong C mode.

[ncoghlan]

Note that this test code:

        def raise_():
            raise MyException
        self.assertRaises(TypeError, raise_)

can be simplified to:

        with self.assertRaises(TypeError):
            raise MyException

in all currently maintained branches.

[Trundle]

Thanks Nick, that is indeed much nicer. I updated the patch.

I also created a patch for 2.7, in case anyone thinks it's a good idea to fix it there, too.

[Trundle]

Another thing that can happen is that __new__() does return an instance of BaseException, but that the return value is not an instance of the expected class.

Example:

class MyException(OSError):
    def __new__(*args):
        return Exception()

try:
raise MyException
except OSError as e:
print(isinstance(e, OSError))

That would print "False". Currently, the patch doesn't check for that, should it do so?

Also, the error message for the 2.7 patch doesn't include that old-style classes are allowed, hence the patch needs to be updated if it should go into 2.7.

[python-dev]

New changeset 8d05f697acd4 by Benjamin Peterson in branch '3.2':
catch nasty exception classes with __new__ that doesn't return a exception (closes bpo-11627)
http://hg.python.org/cpython/rev/8d05f697acd4

New changeset bc1fbd6f667a by Benjamin Peterson in branch 'default':
merge 3.2 (bpo-11627)
http://hg.python.org/cpython/rev/bc1fbd6f667a