Repository navigation
SIGSEV with method descriptors called without a second argument #132747
Description
Crash report
What happened?
Since Python 3.12, the following code triggers a segmentation fault:
import _io, sys; _io._TextIOBase.detach.__get__(sys.stderr)CPython versions tested on:
3.9, 3.11, 3.12, 3.13, 3.14
Operating systems tested on:
Linux
Output from running 'python -VV' on the command line:
No response
Activity
picnixz commentedon Apr 20, 2025
It appears that there is some issue with method resolution. When using
_io.TextIOWrapper, it's fine but not when using_io._TextIOBase.Note:
_io.TextIOWrapper.detachis a different function by the way.Note 2: It actually happens with all method descriptors of
_TextIOBase.[-]Segfault in `_io` module[/-][+]SIGSEV with method descriptors of `_io.TextIOBase` on `sys.stderr`[/+][-]SIGSEV with method descriptors of `_io.TextIOBase` on `sys.stderr`[/-][+]SIGSEV with method descriptors of `_io._TextIOBase`[/+]picnixz commentedon Apr 20, 2025
This also crashes:
Alexandr153 commentedon Apr 20, 2025
As I understand it, the
_TextIOBaseclass is an abstract class because it inherits from the abstractIOBaseclass and does not implement all of its methods.TextIOWrapper, on the other hand, implements all the methods of the parent abstract class and executes its methods directly.picnixz commentedon Apr 20, 2025
Actually, I'm not sure about the resolution. It's as if there was a missing tp_flag somewhere or something else. It doesn't seem to occur with other static types. I don't have time to investigate though.
Changaco commentedon Apr 20, 2025
In addition to
_TextIOBase, the_IOBase,_BufferedIOBase,BufferedReaderandBufferedWriterclasses are also affected.Example:
import io, _io; _io._IOBase.truncate.__get__(io.StringIO()).ZeroIntensity commentedon Apr 21, 2025
From what I can tell, this is a nasty bug related to descriptors themselves, not
_io. You can trigger the same crash with_queue, for example:This seems to affect all heap types with methods. The issue is that
method_getdoesn't expect the type to beNULL. I think we just need a guard.I'm really suprised that nobody noticed this for this long.
Changaco commentedon Apr 21, 2025
I guess nobody noticed this bug before because nobody calls those
__get__methods with only one argument. I only found it accidentally by running Python code that calls all the non-Python__get__methods it can find on objects in memory, without passing the second argument.gh-132747: Fix `NULL` dereference when calling a method's `__get__` m…
[3.13] pythongh-132747: Fix `NULL` dereference when calling a method'…
[3.13] gh-132747: Fix `NULL` dereference when calling a method's `__g…
[-]SIGSEV with method descriptors of `_io._TextIOBase`[/-][+]SIGSEV with method descriptors called without a second argument[/+]picnixz commentedon Apr 24, 2025
Thanks for the report @Changaco and the fix @ZeroIntensity