Skip to content

gh-151763: Fix crash in PyList_New() on allocation failure under low memory - #154019

Open
Abhi210 wants to merge 5 commits into
python:mainfrom
Abhi210:gh-152125
Open

gh-151763: Fix crash in PyList_New() on allocation failure under low memory#154019
Abhi210 wants to merge 5 commits into
python:mainfrom
Abhi210:gh-152125

Conversation

@Abhi210

Copy link
Copy Markdown
Contributor

Fixesgh-152125 (one of the OOM-injection fuzzing findings tracked under the gh-151763 umbrella).

Comment threadObjects/listobject.c Outdated
}
else {
op->ob_item = NULL;
Py_SET_SIZE(op, 0);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The following two commands are safe, IIUC.

Suggested change
Py_SET_SIZE(op, 0);
op->allocated=0;
Py_SET_SIZE(op, size);

Comment threadObjects/listobject.c Outdated

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And then we can remove this Py_SET_SIZE.

Comment threadObjects/listobject.c
@Abhi210
Abhi210force-pushed the gh-152125 branch 2 times, most recently from 8480542 to cfee4d2CompareJuly 19, 2026 13:36
Comment threadObjects/listobject.c Outdated
else {
op->ob_item = NULL;
Py_SET_SIZE(op, size);
op->allocated = size;

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, main idea to set size here, and set allocated=size before GC track. allocated is a gate which stops readers from reading not initialized memory.

So, I propose something like:

op->ob_item = NULL;
op->allocated = 0;
Py_SET_SIZE(op, size);
// ...
// ...
op->allocated = size;
_PyObject_GC_TRACK(op);

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok! I have made the suggested changes. Thank you

@sergey-miryanovsergey-miryanov left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Abort/Segfault: corrupted object freelist in clear_freelist

3 participants

@Abhi210@sergey-miryanov@ByteFlowing1337