gh-142555: Fix null pointer dereference in array.__setitem__ via re-entrant __index__ #142713
+236
−37
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
picnixz
reviewed
Dec 14, 2025
Modules/arraymodule.c
Outdated
| return -1; | ||
| else if (x < -128) { | ||
|
|
||
| /* Check buffer validity after PyArg_Parse which may call user-defined |
Member
There was a problem hiding this comment.
Won't you always have this issue in all *_setitem formatters? none of them seem to check ob_item
Member
There was a problem hiding this comment.
It is also possible that the size was reduced, but ob_item is not NULL. You need to compare the index with the size. This is already checked before calling *_setitem(), but the right place if after calling any user code.
There may also be issues with non-integer formats.
Contributor
Author
There was a problem hiding this comment.
Hi, thanks for the review, I add the check on other *_setitem functions which will invoke a __index__ or __float__ call, and checked size also.
hugovk
reviewed
Dec 15, 2025
Misc/NEWS.d/next/Core_and_Builtins/2025-12-15-02-02-45.gh-issue-142555.EC9QN_.rst
Outdated
Show resolved
Hide resolved
…e-142555.EC9QN_.rst Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
array:*_setitemfunctions & co may crash on re-entrant__index__#142555