Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Incorrect Py_XDECREFs in property #115618

Closed
serhiy-storchaka opened this issue Feb 17, 2024 · 2 comments
Closed

Incorrect Py_XDECREFs in property #115618

serhiy-storchaka opened this issue Feb 17, 2024 · 2 comments
Labels
3.11 only security fixes 3.12 bugs and security fixes 3.13 bugs and security fixes type-crash A hard crash of the interpreter, possibly with a core dump

Comments

@serhiy-storchaka
Copy link
Member

serhiy-storchaka commented Feb 17, 2024

Crash report

When property methods getter(), setter() or deleter() are called with None as argument, they call Py_XDECREF() on it. Now, when None is immortal, it perhaps have no effect, but in earlier Python versions it could have bad consequences. It was not reported earlier only because nobody normally calls them with None.

Linked PRs

@serhiy-storchaka serhiy-storchaka added 3.11 only security fixes type-crash A hard crash of the interpreter, possibly with a core dump 3.12 bugs and security fixes 3.13 bugs and security fixes labels Feb 17, 2024
serhiy-storchaka added a commit to serhiy-storchaka/cpython that referenced this issue Feb 17, 2024
@eltoder
Copy link
Contributor

eltoder commented Feb 17, 2024

@serhiy-storchaka Literally came here to report the same issue :-) It affects versions 3.10 and below, but does not cause a crash since python 3.12 since None became an immortal object.

@eltoder
Copy link
Contributor

eltoder commented Feb 17, 2024

For the benefit of anyone finding this issue, here's a minimal reproduction example:

p = property()
for _ in range(10000): p.getter(None)

results in

Fatal Python error: none_dealloc: deallocating None
Python runtime state: initialized

Current thread 0x00007fcd8c271000 (most recent call first):
  File "<stdin>", line 1 in <module>
Aborted

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3.11 only security fixes 3.12 bugs and security fixes 3.13 bugs and security fixes type-crash A hard crash of the interpreter, possibly with a core dump
Projects
None yet
Development

No branches or pull requests

2 participants