Bug report
What happened?
This is an umbrella issue for 50 select bugs found using cpython-review-toolkit, distributed across ~350K lines of CPython C code (Modules/, Objects/, Python/).
Feel free to work on any report, opening an issue if one doesn't exist yet. Comment with the issue and respective gist/bug here and I'll update the table. If you find an issue listed below that is a duplicate of an existing report, let me know and I'll also mark it in the table.
Modules/ (18 gists)
| Gist | Description | CPython Issue |
|---|
| gist | _ssl.c: Py_DECREF(NULL) in SNI callback | #146080 FIXED |
| gist | _sqlite: collation assertion + missing PyErr_NoMemory | #146090 FIXED |
| gist | functools partial PyDict_Contains -1 as truthy | #146075 FIXED |
| gist | _csv.c: _set_str missing NULL check | #146093 FIXED |
| gist | _zoneinfo: SEGV in get_weak_cache | #146076 FIXED |
| gist | _zoneinfo: missing PyErr_NoMemory in load_data | #146092 FIXED |
| gist | termios: NULL to PyLong_AsLong | #146091 FIXED |
| gist | _struct: segfault/assertion on uninitialized Struct | Fixed in 515ae40 |
| gist | pyexpat: ExternalEntityParserCreate crash | Fixed in e6b9a14 |
| gist | _interpqueuesmodule: use-after-free dangling last | #146427 |
| gist | selectmodule: errno < 0 always false | #146205 FIXED |
| gist | _lsprof: exception clobbering | #153068 FIXED |
| gist | deque.copy() ref corruption on OOM | #152017 |
| gist | readline: begidx NULL on OOM | #154385 |
| gist | zlibmodule: PyErr_NewException unchecked | false alarm |
| gist | socketmodule: audit hook ref/buffer leaks | #146245 FIXED |
| gist | _interpchannelsmodule: missing PyErr_NoMemory | #150213 FIXED |
| gist | _interpretersmodule: SEGV on create under OOM | Fixed in d06113c |
Objects/ (13 gists)
| Gist | Description | CPython Issue |
|---|
| gist | ExceptionGroup repr OOB — 3-line segfault | #146096 FIXED |
| gist | SyntaxError.__init__ ref leaks on re-init | #146250 FIXED |
| gist | codeobject: code_richcompare swallows errors | #146199 FIXED |
| gist | codeobject: co_tlbc NULL + replacement_locations leak | — |
| gist | weakref WRAP_BINARY ref leak (~20 operators) | #153058 |
| gist | FrameLocalsProxy swallows/overwrites errors | — |
| gist | typeobject: missing return -1 in type_ready | commit c398490 |
| gist | typeobject: buffer leak in slot_bf_getbuffer | #151346 FIXED |
| gist | object.c: PyObject_Print missing LeaveRecursiveCall | commit e2fa10e |
| gist | structseq: get_type_attr_as_size NULL deref | #148119 FIXED |
| gist | genericaliasobject: two NULL dereference bugs | #148226 FIXED |
| gist | odictobject: spurious PyErr_Clear | #151347 FIXED |
| gist | unicode_format: wrong return + PY_SSIZE_T_MIN UB | #151845#151847 |
Python/ (16 gists)
| Gist | Description | CPython Issue |
|---|
| gist | import.c: wrong interpreter + double lock release | #150454#150374 FIXED |
| gist | instrumentation.c: PyLong leak per monitoring call | #150379 FIXED |
| gist | instrumentation.c: use-after-Py_DECREF comparison | #151524 |
| gist | ceval.c: missing PyErr_NoMemory + PyEval_GetLocals NULL | #153205 FIXED |
| gist | bltinmodule: __lazy_import__ NULL deref | #151510 FIXED |
| gist | crossinterp: UAF + leaked exception + shadowed var | — |
| gist | compiler pipeline: 6 ref leaks and error bugs | #146442 FIXED |
| gist | marshal: 8 refs leaked on corrupt TYPE_CODE | #148418 FIXED |
| gist | pylifecycle: 5 init/fini cleanup bugs | — |
| gist | initconfig: SET_ITEM macro leaks dict | #146244 FIXED |
| gist | ast.c: LEAVE_RECURSIVE missing on 30 paths | — |
| gist | hamt.c: sub_node leaked in bitmap ops | #150178 |
| gist | pythonrun: main_module ref leak | #146355 FIXED |
| gist | modsupport: missing va_end (UB) | #146386 FIXED |
| gist | legacy_tracing: unchecked PyLong_AsInt | #153622 |
| gist | optimizer_symbols: make_bottom NULL deref | #146388 FIXED |
Duplicates (3 gists — same bugs uploaded from different runs)
| Gist | Duplicate of |
|---|
| gist | ExceptionGroup repr (dup of dceaa8b7) |
| gist | sqlite collation (dup of 69aff7ff) |
| gist | SSL SNI (dup of 50f98806) |
These issues were found with Claude Opus 4.6, using the /cpython-review-toolkit:explore [file or directory] all deep command.
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Output from running 'python -VV' on the command line:
Python 3.15.0a7+ (heads/main:e0f7c1097e1, Mar 17 2026, 18:10:52) [Clang 21.1.2 (2ubuntu6)]
Linked PRs
Bug report
What happened?
This is an umbrella issue for 50 select bugs found using cpython-review-toolkit, distributed across ~350K lines of CPython C code (Modules/, Objects/, Python/).
Feel free to work on any report, opening an issue if one doesn't exist yet. Comment with the issue and respective gist/bug here and I'll update the table. If you find an issue listed below that is a duplicate of an existing report, let me know and I'll also mark it in the table.
Modules/ (18 gists)
Objects/ (13 gists)
SyntaxError.__init__ref leaks on re-initPython/ (16 gists)
__lazy_import__NULL derefDuplicates (3 gists — same bugs uploaded from different runs)
These issues were found with Claude Opus 4.6, using the
/cpython-review-toolkit:explore [file or directory] all deepcommand.CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Output from running 'python -VV' on the command line:
Python 3.15.0a7+ (heads/main:e0f7c1097e1, Mar 17 2026, 18:10:52) [Clang 21.1.2 (2ubuntu6)]
Linked PRs
pylifecycle.c#151534