Skip to content

gh-151763: Fix crash in PyList_New() on allocation failure under low memory#154019

Open
Abhi210 wants to merge 3 commits into
python:mainfrom
Abhi210:gh-152125
Open

gh-151763: Fix crash in PyList_New() on allocation failure under low memory#154019
Abhi210 wants to merge 3 commits into
python:mainfrom
Abhi210:gh-152125

Conversation

@Abhi210

@Abhi210 Abhi210 commented Jul 18, 2026

Copy link
Copy Markdown
Contributor

Fixes gh-152125 (one of the OOM-injection fuzzing findings tracked under the gh-151763 umbrella).

Comment thread Objects/listobject.c Outdated
}
else {
op->ob_item = NULL;
Py_SET_SIZE(op, 0);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The following two commands are safe, IIUC.

Suggested change
Py_SET_SIZE(op, 0);
op->allocated = 0;
Py_SET_SIZE(op, size);

Comment thread Objects/listobject.c Outdated

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And then we can remove this Py_SET_SIZE.

Comment thread Objects/listobject.c Outdated
else {
op->ob_item = NULL;
Py_SET_SIZE(op, 0);
op->allocated = 0;

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
op->allocated = 0;

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, for clarification, should I make the following changes?

+ op->ob_item = NULL;
- Py_SET_SIZE(op, 0);
- op->allocated = 0;

And keep the Py_SET_SIZE(op, size); at the end?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we call Py_SET_SIZE(op, size); at the top, then we don't need to repeat it at the bottom, IIUC.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have made the suggested changes by putting Py_SET_SIZE(op, 0); and op->allocated = 0;. The reproduction script runs successfully without any crash.

Comment thread Misc/NEWS.d/next/Core_and_Builtins/2026-07-18-22-56-27.gh-issue-152125.sEPvJf.rst Outdated
@Abhi210
Abhi210 force-pushed the gh-152125 branch 2 times, most recently from 8480542 to cfee4d2 Compare July 19, 2026 13:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Abort/Segfault: corrupted object freelist in clear_freelist

3 participants