Uh oh!
There was an error while loading. Please reload this page.
gh-151815: Fix segfault in template_iter on allocation failure - #151821
gh-151815: Fix segfault in template_iter on allocation failure#151821timurmamedov1 wants to merge 2 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
Fixes a crash in the C implementation of t-string Template iteration by making the iterator object safe to deallocate when construction fails partway through (e.g., on PyObject_GetIter() allocation failure).
Changes:
- Initialize
templateiterobject’sstringsiterandinterpolationsitertoNULLimmediately afterPyObject_GC_New()sotp_clear/Py_CLEARis safe on error paths. - Add a NEWS blurb documenting the crash fix.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
Objects/templateobject.c | Prevents segfault by NULL-initializing iterator fields before any fallible operations. |
Misc/NEWS.d/next/Core_and_Builtins/2026-06-20-14-00-00.gh-issue-151815.TmplIt.rst | Documents the crash fix in the Core and Builtins NEWS entries. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| return NULL; | ||
| } | ||
| iter->stringsiter = NULL; | ||
| iter->interpolationsiter = NULL; |
645d1c2 to
01f7dbfCompareMost changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
aa005aa to
5653555Compareb6dc145 to
8e5d35cCompare| @@ -226,6 +226,8 @@ template_iter(PyObject *op) | |||
There was a problem hiding this comment.
I would suggest moving allocation after getting interpolationsiter.
There was a problem hiding this comment.
Done, moved the allocation after both GetIter calls.
template_iter()allocates atemplateiterobjectwithPyObject_GC_New(which does not zero memory), but only assignsstringsiterandinterpolationsiterafter bothPyObject_GetItercalls succeed. If either call fails,Py_DECREF(iter)runstemplateiter_clear, which callsPy_CLEARon uninitialized pointers, causing a segfault.Fix: initialize both fields to
NULLimmediately after allocation soPy_CLEARis safe on the error paths.