gh-143635: Fix crash in `_Py_typing_type_repr` by sobolevn · Pull Request #143670 · python/cpython

sobolevn · 2026-01-10T22:49:09Z

I also added one more test case for a second possible crash in the same function.

Issue: Use-after-free in _Py_typing_type_repr via re-entrant __origin__ lookup during GenericAlias repr #143635

Objects/typevarobject.c

JelleZijlstra · 2026-01-11T16:14:58Z

This needs NEWS since it fixes a user-visible crash.

JelleZijlstra

Actually this is incorrect. The crash can be triggered if the list is cleared while we're iterating over it in ga_repr_items_list. INCREFing here is insufficient to protect us because the item may not be valid in the first place any more by the time we receive it.

My repro case in #143823 makes this clearer.

bedevere-app · 2026-01-14T03:09:36Z

When you're done making the requested changes, leave the comment: I have made the requested changes; please review again.

sobolevn · 2026-01-14T08:15:41Z

Thank you! I refactored the PR to include the fix for the third case.

picnixz · 2026-01-14T17:58:12Z

I thought there were more occurrences pf this function but am I wrong? or is it just me on mobile?

picnixz · 2026-01-14T18:00:05Z

Or is it just in recursive calls where we already hold enough strong references?

JelleZijlstra · 2026-01-14T18:05:58Z

The other calls look safe to me.

miss-islington-app · 2026-01-15T03:50:51Z

Thanks @sobolevn for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

(cherry picked from commit bdba5f0) Co-authored-by: sobolevn <mail@sobolevn.me>

miss-islington-app · 2026-01-15T03:50:58Z

Sorry, @sobolevn, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker bdba5f0db2ab29f3deedb9416f3c143d33e4ab66 3.13

bedevere-app · 2026-01-15T03:51:05Z

GH-143851 is a backport of this pull request to the 3.14 branch.

bedevere-app · 2026-01-15T03:54:56Z

GH-143852 is a backport of this pull request to the 3.13 branch.

…43670) (cherry picked from commit bdba5f0) Co-authored-by: sobolevn <mail@sobolevn.me>

) gh-143635: Fix crash in `ga_repr_items_list` (GH-143670) (cherry picked from commit bdba5f0) Co-authored-by: sobolevn <mail@sobolevn.me>

) (cherry picked from commit bdba5f0)

bedevere-bot · 2026-01-15T16:15:12Z

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot ARM64 macOS 3.13 (tier-2) has failed when building commit aa5ad50.

What do you need to do:

Don't panic.
Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
Go to the page of the buildbot that failed (https://buildbot.python.org/#/builders/1404/builds/1470) and take a look at the build logs.
Check if the failure is related to this commit (aa5ad50) or if it is a false positive.
If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/#/builders/1404/builds/1470

Failed tests:

test.test_multiprocessing_forkserver.test_processes
test_urllib2net

Failed subtests:

test_repr_rlock - test.test_multiprocessing_forkserver.test_processes.WithProcessesTestLock.test_repr_rlock

Summary of the results of the build (if available):

==

Click to see traceback logs

Traceback (most recent call last):
  File "/Users/buildbot/buildarea/3.13.pablogsal-macos-m1.macos-with-brew/build/Lib/test/_test_multiprocessing.py", line 1493, in test_repr_rlock
    self.assertEqual('<RLock(SomeOtherThread, nonzero)>', repr(lock))
    ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError: '<RLock(SomeOtherThread, nonzero)>' != '<RLock(None, 0)>'
- <RLock(SomeOtherThread, nonzero)>
+ <RLock(None, 0)>

pythongh-143635: Fix crash in _Py_typing_type_repr

5b3b3f5

sobolevn requested a review from JelleZijlstra as a code owner January 10, 2026 22:49

bedevere-app bot mentioned this pull request Jan 10, 2026

Use-after-free in _Py_typing_type_repr via re-entrant __origin__ lookup during GenericAlias repr #143635

Closed

bedevere-app bot added the awaiting core review label Jan 10, 2026

sobolevn added skip news needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Jan 10, 2026

JelleZijlstra reviewed Jan 11, 2026

View reviewed changes

Objects/typevarobject.c Outdated Show resolved Hide resolved

sobolevn removed the skip news label Jan 11, 2026

pythongh-143635: Fix crash in _Py_typing_type_repr

0eee5b8

JelleZijlstra requested changes Jan 14, 2026

View reviewed changes

bedevere-app bot added awaiting changes and removed awaiting core review labels Jan 14, 2026

JelleZijlstra mentioned this pull request Jan 14, 2026

Crash in GenericAlias repr() with a self-mutating list #143823

Closed

Fix the third crash

4e08352

sobolevn force-pushed the issue-143635 branch from a811a1d to 4e08352 Compare January 14, 2026 08:16

JelleZijlstra approved these changes Jan 14, 2026

View reviewed changes

bedevere-app bot added awaiting merge and removed awaiting changes labels Jan 14, 2026

sobolevn requested a review from picnixz January 14, 2026 16:57

picnixz approved these changes Jan 14, 2026

View reviewed changes

sobolevn merged commit bdba5f0 into python:main Jan 15, 2026
50 of 51 checks passed

bedevere-app bot removed the awaiting merge label Jan 15, 2026

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jan 15, 2026

pythongh-143635: Fix crash in ga_repr_items_list (pythonGH-143670)

71ce6ce

(cherry picked from commit bdba5f0) Co-authored-by: sobolevn <mail@sobolevn.me>

miss-islington-app bot assigned sobolevn Jan 15, 2026

bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Jan 15, 2026

bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Jan 15, 2026

sobolevn added a commit to sobolevn/cpython that referenced this pull request Jan 15, 2026

[3.13] pythongh-143635: Fix crash in ga_repr_items_list (pythonGH-1…

67abd1b

…43670) (cherry picked from commit bdba5f0) Co-authored-by: sobolevn <mail@sobolevn.me>

sobolevn added a commit that referenced this pull request Jan 15, 2026

[3.14] gh-143635: Fix crash in ga_repr_items_list (GH-143670) (#143851

38f0114

) gh-143635: Fix crash in `ga_repr_items_list` (GH-143670) (cherry picked from commit bdba5f0) Co-authored-by: sobolevn <mail@sobolevn.me>

sobolevn added a commit that referenced this pull request Jan 15, 2026

[3.13] gh-143635: Fix crash in ga_repr_items_list (GH-143670) (#143852

aa5ad50

) (cherry picked from commit bdba5f0)

thunder-coding pushed a commit to thunder-coding/cpython that referenced this pull request Feb 15, 2026

pythongh-143635: Fix crash in ga_repr_items_list (python#143670)

6b6c5bd

Uh oh!

Conversation

sobolevn commented Jan 10, 2026 • edited by bedevere-app bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

JelleZijlstra commented Jan 11, 2026

Uh oh!

JelleZijlstra left a comment

Choose a reason for hiding this comment

Uh oh!

bedevere-app bot commented Jan 14, 2026

Uh oh!

sobolevn commented Jan 14, 2026

Uh oh!

picnixz commented Jan 14, 2026

Uh oh!

picnixz commented Jan 14, 2026

Uh oh!

JelleZijlstra commented Jan 14, 2026

Uh oh!

Uh oh!

miss-islington-app bot commented Jan 15, 2026

Uh oh!

miss-islington-app bot commented Jan 15, 2026

Uh oh!

bedevere-app bot commented Jan 15, 2026

Uh oh!

bedevere-app bot commented Jan 15, 2026

Uh oh!

bedevere-bot commented Jan 15, 2026

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

sobolevn commented Jan 10, 2026 •

edited by bedevere-app bot

Loading