From c0f7903662e864b9d8c32206bdea266837e0ecf2 Mon Sep 17 00:00:00 2001 From: Stan Ulbrych Date: Mon, 3 Nov 2025 17:23:50 +0000 Subject: [PATCH 1/5] Commit --- Lib/test/test_bytes.py | 6 ++++++ .../2025-11-03-17-21-38.gh-issue-140939.FVboAw.rst | 2 ++ Objects/bytesobject.c | 1 + 3 files changed, 9 insertions(+) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2025-11-03-17-21-38.gh-issue-140939.FVboAw.rst diff --git a/Lib/test/test_bytes.py b/Lib/test/test_bytes.py index f10e4041937f4f..febe99320dbd46 100644 --- a/Lib/test/test_bytes.py +++ b/Lib/test/test_bytes.py @@ -802,6 +802,12 @@ def __int__(self): with self.assertRaisesRegex(TypeError, msg): operator.mod(format_bytes, value) + # gh-140939: MemoryError is raised without leaking + for _ in range(100): + with self.assertRaises(MemoryError): + b = self.type2test(b'%*b') + b % (2**63-1, b'abc') + def test_imod(self): b = self.type2test(b'hello, %b!') orig = b diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2025-11-03-17-21-38.gh-issue-140939.FVboAw.rst b/Misc/NEWS.d/next/Core_and_Builtins/2025-11-03-17-21-38.gh-issue-140939.FVboAw.rst new file mode 100644 index 00000000000000..a2921761f75556 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2025-11-03-17-21-38.gh-issue-140939.FVboAw.rst @@ -0,0 +1,2 @@ +Fix memory leak when :class:`bytearray` or :class:`bytes` is formated with the +``%*b`` format with a large width that results in a :exc:`MemoryError`. diff --git a/Objects/bytesobject.c b/Objects/bytesobject.c index 9c807b3dd166ee..2b9513abe91956 100644 --- a/Objects/bytesobject.c +++ b/Objects/bytesobject.c @@ -985,6 +985,7 @@ _PyBytes_FormatEx(const char *format, Py_ssize_t format_len, if (alloc > 2) { res = PyBytesWriter_GrowAndUpdatePointer(writer, alloc - 2, res); if (res == NULL) { + Py_XDECREF(temp); goto error; } } From fcf8d1b83d7b3584f30da66a305fb201b6c2a136 Mon Sep 17 00:00:00 2001 From: Stan Ulbrych Date: Mon, 3 Nov 2025 17:36:14 +0000 Subject: [PATCH 2/5] Catch OverflowError too --- Lib/test/test_bytes.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Lib/test/test_bytes.py b/Lib/test/test_bytes.py index febe99320dbd46..af0d1a15e29f41 100644 --- a/Lib/test/test_bytes.py +++ b/Lib/test/test_bytes.py @@ -804,7 +804,7 @@ def __int__(self): # gh-140939: MemoryError is raised without leaking for _ in range(100): - with self.assertRaises(MemoryError): + with self.assertRaises((MemoryError, OverflowError)): b = self.type2test(b'%*b') b % (2**63-1, b'abc') From 2640e6e53d47d427d1a87af09f481fc4b596ea92 Mon Sep 17 00:00:00 2001 From: Stan Ulbrych Date: Wed, 5 Nov 2025 21:32:36 +0000 Subject: [PATCH 3/5] Remove loop per Victor's review --- Lib/test/test_bytes.py | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/Lib/test/test_bytes.py b/Lib/test/test_bytes.py index af0d1a15e29f41..48c64c21a72d40 100644 --- a/Lib/test/test_bytes.py +++ b/Lib/test/test_bytes.py @@ -803,10 +803,9 @@ def __int__(self): operator.mod(format_bytes, value) # gh-140939: MemoryError is raised without leaking - for _ in range(100): - with self.assertRaises((MemoryError, OverflowError)): - b = self.type2test(b'%*b') - b % (2**63-1, b'abc') + with self.assertRaises((MemoryError, OverflowError)): + b = self.type2test(b'%*b') + b % (2**63-1, b'abc') def test_imod(self): b = self.type2test(b'hello, %b!') From 99d1b6b83e71befa4982adbe777196aea463ab63 Mon Sep 17 00:00:00 2001 From: Stan Ulbrych Date: Wed, 5 Nov 2025 21:33:54 +0000 Subject: [PATCH 4/5] _testcapi.PY_SSIZE_T_MAX --- Lib/test/test_bytes.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/Lib/test/test_bytes.py b/Lib/test/test_bytes.py index 48c64c21a72d40..402f0ee1097081 100644 --- a/Lib/test/test_bytes.py +++ b/Lib/test/test_bytes.py @@ -803,9 +803,10 @@ def __int__(self): operator.mod(format_bytes, value) # gh-140939: MemoryError is raised without leaking - with self.assertRaises((MemoryError, OverflowError)): + _testcapi = import_helper.import_module('_testcapi') + with self.assertRaises(MemoryError): b = self.type2test(b'%*b') - b % (2**63-1, b'abc') + b % (_testcapi.PY_SSIZE_T_MAX, b'abc') def test_imod(self): b = self.type2test(b'hello, %b!') From 873679fbff2e06ff25c38e78ce2ada3c5489c8e8 Mon Sep 17 00:00:00 2001 From: Stan Ulbrych Date: Wed, 5 Nov 2025 21:40:30 +0000 Subject: [PATCH 5/5] Move test --- Lib/test/test_bytes.py | 1 + 1 file changed, 1 insertion(+) diff --git a/Lib/test/test_bytes.py b/Lib/test/test_bytes.py index 402f0ee1097081..e012042159d223 100644 --- a/Lib/test/test_bytes.py +++ b/Lib/test/test_bytes.py @@ -802,6 +802,7 @@ def __int__(self): with self.assertRaisesRegex(TypeError, msg): operator.mod(format_bytes, value) + def test_memory_leak_gh_140939(self): # gh-140939: MemoryError is raised without leaking _testcapi = import_helper.import_module('_testcapi') with self.assertRaises(MemoryError):