_PyErr_CreateException() must check that the result is an exception (CPython Segfault in 5 lines of code)

[sekrause]

BPO	39091
Nosy	@tiran, @benjaminp, @ambv, @serhiy-storchaka, @miss-islington, @sekrause, @coolreader18
PRs	bpo-39091: Fix segfault when Exception constructor returns non-exception for gen.throw #17658 [3.10] closes bpo-39091: Fix segfault when Exception constructor returns non-exception for gen.throw. (GH-17658) #27572 [3.9] closes bpo-39091: Fix segfault when Exception constructor returns non-exception for gen.throw. (GH-17658) #27573

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2021-08-03.02:17:33.440>
created_at = <Date 2019-12-18.18:45:15.070>
labels = ['interpreter-core', '3.10', '3.8', '3.9', 'type-crash']
title = '_PyErr_CreateException() must check that the result is an exception (CPython Segfault in 5 lines of code)'
updated_at = <Date 2021-08-03.10:11:05.815>
user = 'https://github.com/sekrause'

bugs.python.org fields:

activity = <Date 2021-08-03.10:11:05.815>
actor = 'lukasz.langa'
assignee = 'none'
closed = True
closed_date = <Date 2021-08-03.02:17:33.440>
closer = 'benjamin.peterson'
components = ['Interpreter Core']
creation = <Date 2019-12-18.18:45:15.070>
creator = 'skrause'
dependencies = []
files = []
hgrepos = []
issue_num = 39091
keywords = ['patch']
message_count = 7.0
messages = ['358639', '358640', '358643', '358649', '398813', '398817', '398818']
nosy_count = 7.0
nosy_names = ['christian.heimes', 'benjamin.peterson', 'lukasz.langa', 'serhiy.storchaka', 'miss-islington', 'skrause', 'coolreader18']
pr_nums = ['17658', '27572', '27573']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue39091'
versions = ['Python 3.8', 'Python 3.9', 'Python 3.10']

[sekrause]

The following lines trigger a segmentation fault:

class E(BaseException):
    def __new__(cls, *args, **kwargs):
        return cls
def a(): yield
a().throw(E)

Source with a bit more explanation: https://gist.github.com/coolreader18/6dbe0be2ae2192e90e1a809f1624c694 (I'm not the author of that gist, just reporting it here).

[tiran]

I can reproduce the issue on master:

>>> class E(BaseException):
...     def __new__(cls, *args, **kwargs):
...         return cls
... 
>>> def a(): yield
... 
>>> a().throw(E)

Program received signal SIGSEGV, Segmentation fault.
_Py_DECREF (op=<unknown at remote 0x48>, lineno=541, filename=0x61717f "./Include/object.h") at ./Include/object.h:470
470 if (--op->ob_refcnt != 0) {
(gdb) bt
#0 _Py_DECREF (op=<unknown at remote 0x48>, lineno=541, filename=0x61717f "./Include/object.h") at ./Include/object.h:470
#1 _Py_XDECREF (op=<unknown at remote 0x48>) at ./Include/object.h:541
#2 BaseException_set_tb (self=0x837290, tb=<traceback at remote 0x7fffeaaa2c80>, _unused_ignored=_unused_ignored@entry=0x0) at Objects/exceptions.c:234
#3 0x00000000004335bd in PyException_SetTraceback (self=<optimized out>, tb=<optimized out>) at Objects/exceptions.c:319
#4 0x000000000051b6df in _PyErr_PrintEx (tstate=0x78c7c0, set_sys_last_vars=set_sys_last_vars@entry=1) at Python/pythonrun.c:680
#5 0x000000000051bc1f in PyErr_PrintEx (set_sys_last_vars=set_sys_last_vars@entry=1) at Python/pythonrun.c:763
#6 0x000000000051bc32 in PyErr_Print () at Python/pythonrun.c:769
#7 0x000000000051ca1e in PyRun_InteractiveLoopFlags (fp=fp@entry=0x7ffff7de07e0 <IO_2_1_stdin>, filename_str=filename_str@entry=0x617126 "<stdin>", flags=flags@entry=0x7fffffffd7f0) at Python/pythonrun.c:135
#8 0x000000000051d0d0 in PyRun_AnyFileExFlags (fp=0x7ffff7de07e0 <IO_2_1_stdin>, filename=filename@entry=0x617126 "<stdin>", closeit=closeit@entry=0, flags=flags@entry=0x7fffffffd7f0) at Python/pythonrun.c:80
#9 0x000000000041deda in pymain_run_stdin (config=config@entry=0x78b0e0, cf=cf@entry=0x7fffffffd7f0) at Modules/main.c:467
#10 0x000000000041ea37 in pymain_run_python (exitcode=exitcode@entry=0x7fffffffd82c) at Modules/main.c:556
#11 0x000000000041ea76 in Py_RunMain () at Modules/main.c:632
#12 0x000000000041eacb in pymain_main (args=args@entry=0x7fffffffd870) at Modules/main.c:662
#13 0x000000000041eb47 in Py_BytesMain (argc=<optimized out>, argv=<optimized out>) at Modules/main.c:686
#14 0x000000000041d6df in main (argc=<optimized out>, argv=<optimized out>) at ./Programs/python.c:16

[serhiy-storchaka]

Good catch! Since you already investigated the code, do you mind to create a PR which fixes a crash? I think that adding PyExceptionInstance_Check() in _PyErr_CreateException() could fix the issue.

[coolreader18]

I'm not sure if this will actually appear as a message (I just registered for the bug tracker and I'm not sure how it works), but I wrote the gist and I can definitely make a PR.

[benjaminp]

New changeset 83ca46b by Noah in branch 'main':
closes bpo-39091: Fix segfault when Exception constructor returns non-exception for gen.throw. (bpo-17658)
83ca46b

[ambv]

New changeset 8ce7f2f by Miss Islington (bot) in branch '3.10':
bpo-39091: Fix segfault when Exception constructor returns non-exception for gen.throw. (GH-17658) (GH-27572)
8ce7f2f

[ambv]

New changeset 0b551db by Miss Islington (bot) in branch '3.9':
bpo-39091: Fix segfault when Exception constructor returns non-exception for gen.throw. (GH-17658) (GH-27573)
0b551db