Segfault: NULL info deref in _excinfo_clear_type via _PyXI_FreeExcInfo(NULL) (Python/crossinterp.c:1319)

[amruthamodela06]

Crash report

Segfault: NULL info deref in _excinfo_clear_type via _PyXI_FreeExcInfo(NULL)

_interpreters.capture_exception() builds a _PyXI_excinfo via _PyXI_NewExcInfo(). Under memory pressure that allocation can fail and return NULL. The cleanup path in _interpreters_capture_exception_impl then unconditionally calls _PyXI_FreeExcInfo(info) with info == NULL. _PyXI_FreeExcInfo has no NULL guard, so _PyXI_excinfo_clear → _excinfo_clear_type dereferences &NULL->type (offset 0) at Python/crossinterp.c:1319 → SIGSEGV.

This reproduces on all build configurations (a NULL dereference, not a debug-only assert).

Reproducer

import faulthandler, _interpreters
faulthandler.enable()
from _testcapi import set_nomemory, remove_mem_hooks
for start in range(0, 40):
 try:
 set_nomemory(start, 0)
 try:
 _interpreters.capture_exception(Exception())
 finally:
 remove_mem_hooks()
 except BaseException:
 pass
 finally:
 try: remove_mem_hooks()
 except Exception: pass

Backtrace

#0 _excinfo_clear_type Python/crossinterp.c:1319 # info == 0x0 -> offset-0 deref
#1 _PyXI_excinfo_clear Python/crossinterp.c:1374
#2 _PyXI_FreeExcInfo Python/crossinterp.c:1712 # called with info == NULL, no guard
#3 _interpreters_capture_exception_impl Modules/_interpretersmodule.c:1544
#4 cfunction_vectorcall_FASTCALL_KEYWORDS Objects/methodobject.c:465

Root cause

Modules/_interpretersmodule.c, _interpreters_capture_exception_impl (≈L1522-1544):

_PyXI_excinfo *info = _PyXI_NewExcInfo(exc); /* returns NULL under OOM */
if (info == NULL) {
 goto finally;
}
/* ... */
finally:
 _PyXI_FreeExcInfo(info); /* L1544: runs even when info == NULL */

_PyXI_NewExcInfo (crossinterp.c:1683) does PyMem_RawCalloc for its struct and, on any failure, PyMem_RawFrees it and returns NULL — so info here is a clean NULL, not a dangling half-built struct.

_PyXI_FreeExcInfo (crossinterp.c:1710) has no NULL guard:

void
_PyXI_FreeExcInfo(_PyXI_excinfo *info)
{
 _PyXI_excinfo_clear(info); /* dereferences info */
 PyMem_RawFree(info);
}

Suggested fix

Make _PyXI_FreeExcInfo NULL-safe, matching the surrounding PyMem_RawFree(NULL) idiom (and Py_XDECREF, free(), etc.):

void
_PyXI_FreeExcInfo(_PyXI_excinfo *info)
{
 if (info == NULL) {
 return;
 }
 _PyXI_excinfo_clear(info);
 PyMem_RawFree(info);
}

This is more defensive than guarding only the one call site, since the function is part of the cross-interpreter exception ABI and any future caller would otherwise have the same hazard.

Notes

Part of #151763 (umbrella tracking 35 OOM-related crash findings); OOM-0031 in that table.

CPython versions tested on:

CPython main branch (3.16.0a0)

Operating systems tested on:

Linux, Windows

Linked PRs

• gh-151842: Make _PyXI_FreeExcInfo NULL-safe to fix crash on capture_exception() OOM (OOM-0031) #151843
• [3.15] gh-151842: Fix crash upon OOM in _interpreters.capture_exception (GH-151843) #152031
• [3.14] gh-151842: Fix crash upon OOM in _interpreters.capture_exception (GH-151843) #152032