Files
Jeong, YunWon d5d19e0611 Fix 33 reproduced fuzzing and static-review defects (#8514)
* mmap: guard move() against dest/src past the mapping size

An offset larger than the mapping made `size - dest` underflow, producing
an out-of-range slice index panic. Check the high side first, as write() does.

Assisted-by: Claude

* exceptions: keep ImportError name/path/name_from out of an empty instance dict

ImportError.__reduce__ unwrapped get_arg(0), which is None when the exception
was constructed with no positional argument, aborting on pickle.dumps(ImportError()).
Fall back to the full args tuple there, and expose name/path/name_from as class
attributes defaulting to None so a bare ImportError() reduces to (cls, ()).

Assisted-by: Claude

* asyncio: stop unwrapping the _current_tasks downcast in current_task()

_asyncio._current_tasks is a reassignable module attribute; the three sibling
functions already degrade gracefully when it is not a dict, current_task() did not.

Assisted-by: Claude

* asyncio: raise TypeError when FutureIter.throw()'s exception class returns a non-exception

exc_type.call() goes through a Python-controlled __new__, so its result can be
any object; the downcast was unwrapped. Report it as a TypeError instead.

Assisted-by: Claude

* sequence: use a fallible reservation for sequence repetition

The guard only rejects a repeat whose per-element size crosses MAX_MEMORY_SIZE,
so (1,) * (10**12) still reached Vec::with_capacity and aborted in the allocator.
Reserve fallibly and surface a MemoryError.

Assisted-by: Claude

* collections: reject an oversized deque repetition with MemoryError

deque * sys.maxsize reached the allocator and aborted with a capacity overflow.
Apply the MAX_MEMORY_SIZE guard the other sequences already carry.

Assisted-by: Claude

* itertools: raise OverflowError for an out-of-range r argument

combinations/combinations_with_replacement/permutations narrowed r with
to_usize().unwrap(), so r=2**64 panicked instead of raising.

Assisted-by: Claude

* math: stream the generic sumprod path instead of collecting both iterables

The big-int path collected each argument into a Vec before multiplying, so an
unbounded iterable exhausted memory. Advance both iterators in lockstep and
accumulate, reporting a length mismatch when only one is exhausted.

Assisted-by: Claude

* _imp: raise TypeError for a second positional argument to find_frozen

withdata is keyword-only and unimplemented; passing it positionally hit an
unimplemented!() and aborted.

Assisted-by: Claude

* _typing: check _idfunc arity before indexing args

_typing._idfunc() with no argument indexed args[0] out of bounds.

Assisted-by: Claude

* exceptions: require a sequence for the ExceptionGroup excs argument

The argument was collected before being validated, so an unbounded iterable
such as itertools.count() exhausted memory. Reject a non-sequence up front.

Assisted-by: Claude

* mmap: treat an inverted find/rfind range as empty

find(b"x", 5, 2) built a slice whose start exceeded its end and panicked.

Assisted-by: Claude

* collections: give deque and defaultdict a GC traverse

Neither type opted into traversal, so a reference cycle through a deque or a
defaultdict was never collected.

Assisted-by: Claude

* itertools: opt the iterator types into GC traverse

cycle and its siblings hold Python references but declared no traverse, so a
cycle built through one of them leaked.

Assisted-by: Claude

* _ctypes: mask an out-of-range int instead of panicking

c_char_p(2**64) and pointer item assignment called .expect() on the narrowing
conversion. Wrap the value to the target width, which is what the C
implementation stores.

Assisted-by: Claude

* hashlib: import _hashlib when a hash module is loaded

The hash object type is a static type owned by _hashlib; calling _md5.md5()
without _hashlib imported hit an uninitialized static type and panicked.

Assisted-by: Claude

* _csv: fall back to the built-in dialect defaults when none is registered

The dialect table is empty until csv.py registers 'excel', so _csv.reader([])
unwrapped a missing entry and panicked.

Assisted-by: Claude

* builtins: reject surrogates in compile()/eval() source instead of panicking

expect_str() panics on a str containing surrogates; convert with try_as_utf8
so eval(chr(0xd800)) raises.

Assisted-by: Claude

* _suggestions: require a list for _generate_suggestions candidates

The argument was collected before validation, so an unbounded iterable
exhausted memory.

Assisted-by: Claude

* lzma: size the filter chain before consuming it

filters= was collected into a Vec before the length check, so an unbounded
iterable exhausted memory. Take the length through the sequence protocol first.

Assisted-by: Claude

* classmethod: opt into GC traverse

staticmethod already declares traverse; classmethod did not, so a cycle through
the wrapped callable leaked.

Assisted-by: Claude

* posix: reject unbounded iterables in posix_spawn and setgroups

argv, setsigdef, setsigmask and setgroups bound an ArgIterable and collected it
before validating, so an infinite generator exhausted memory. Require a
list/tuple for argv, validate signals while streaming, and take setgroups
through the sequence protocol.

Assisted-by: Claude

* _ctypes: size Array slice assignment and _argtypes_ before collecting

Both eagerly collected their argument, so an unbounded iterable exhausted
memory before the length check ran.

Assisted-by: Claude

* sys: propagate the breakpointhook warning failure

warn() was unwrapped, so an unimportable $PYTHONBREAKPOINT under
-W error panicked instead of raising.

Assisted-by: Claude

* structseq: require the sequence argument when constructing a struct sequence

A no-argument construction produced an empty backing tuple, and reading any
named field then indexed out of bounds.

Assisted-by: Claude

* Guard the hash slot dispatch against unbounded recursion

`PyObject::hash` invoked the type's hash slot directly, so an element-wise
`__hash__` following a deeply nested object graph recursed one native frame
per level and overflowed the stack. Wrap the dispatch in `with_recursion`,
matching the repr and rich-compare dispatches in the same file, so
`hash(x)` on a nested tuple/GenericAlias/slice raises `RecursionError`.

Assisted-by: Claude

* genericalias: guard the __parameters__ walk against unbounded recursion

`make_parameters_from_slice` recursed into every list/tuple argument with
nothing counting the frames, so `list[L]` for a self-referential or deeply
nested `L` overflowed the native stack at subscript time. Wrap the descent
in `with_recursion`, which makes the walk fallible; `PyGenericAlias::new`,
`from_args` and `make_parameters` now return `PyResult` and every caller
propagates.

Assisted-by: Claude

* Fix the type confusion in PyAtomicRef's Debug impl

`PyAtomicRef<T>` stores a pointer to a `Py<T>`, as `Deref`, `load_raw`,
`swap` and `Drop` all read it, but `Debug` cast it to a bare `T` and
formatted the object header as payload bytes. For `PyFunction`, whose
`code: PyAtomicRef<PyCode>` has a pointer-chasing `Debug`, that
dereferenced header words and segfaulted.

Cast to `PyObject` instead, which is what `Drop` already does and which
also covers the `PyAtomicRef<PyObject>` and `PyAtomicRef<Option<T>>`
instantiations that have no `Py<T>`.

`_asyncio._enter_task` reached this through `{:?}` in its "Cannot enter
into task" message; format the two tasks with their Python repr, which is
what the message is meant to show.

Assisted-by: Claude

* _sre: disallow instantiating Match

`Match` inherited `object.__new__`, so `M.__new__(M)` produced an instance
whose `regs`/`string`/`pattern` were never filled in by a match run; the
mapping subscript path read them and dereferenced garbage. The type has no
public constructor, so mark it `DISALLOW_INSTANTIATION`, which makes
`M.__new__(M)` raise `TypeError: cannot create 're.Match' instances`.

Assisted-by: Claude

* utils: return the empty repr instead of asserting a non-empty collection

`collection_repr` took the first element with an `.expect()` justified by the
caller's preceding non-empty check. Another thread clearing the collection
between that check and the iteration made the iterator yield nothing and
panicked the worker. Fall back to the caller-supplied empty form, which is
the text those callers already produce for an empty collection.

Assisted-by: Claude

* itertools: advance cycle's index atomically

`cycle.__next__` did `fetch_add(1)` and then reset the index to 0 in a
separate store, so two threads replaying the saved items could both read an
index past the end of `saved` and panic on the slice access. Do the advance
and the wrap in one `fetch_update`.

Assisted-by: Claude

* _ctypes: reject a float argument to a foreign call without argtypes

`conv_param`, the conversion used when `argtypes` is not set, converted its
argument with `try_int`, which goes through `__int__` and so accepts a
float. `libc.strlen(1.5)` therefore passed 1 where the callee expects a
`char *` and the callee dereferenced it. Match `ConvParam`, which does a
`PyLong_Check` and converts nothing: take the branch only for an `int` (or
a subclass, so `True` still converts), and let a float fall through to
"Don't know how to convert parameter".

The branch below it converted a float to a C double, but `try_int` claimed
every float before it could run, so it was dead; `CArgValue::Double`
existed only for that branch and both go. Typed doubles are unaffected —
they travel as `CArgValue::Typed` with code 'd'.

Assisted-by: Claude

* Report the iterator itself from PyIter's traverse

`Traverse for PyIter<O>` delegated to the inherent `PyObject::traverse` of
the object it wraps, so it reported that iterator's referents instead of
the iterator. The iterator's own reference to those referents was then
never subtracted during the collector's reference-subtraction pass, the
referents kept a non-zero gc_refs, and every object reachable from them
was classified as a root.

Any cycle running through a type with a `PyIter` field therefore survived
collection: `map`, `filter`, `zip`, `enumerate`, `reversed` and the
`itertools` iterators all leaked, while the same cycle through a `list`,
`tuple` or `list_iterator` collected. Report the wrapped object, as the
`PyObjectRef`, `PyRef<T>` and `PyStackRef` impls do.

`itertools.tee` still leaks: its shared buffer is a `PyRc<PyItertoolsTeeData>`
rather than a Python object, so the collector cannot see through it.

Assisted-by: Claude

* Remove the obsolete expectedFailure on test_code_module.test_unicode_error

Compiling a source string containing a lone surrogate now raises
UnicodeEncodeError, so the test passes.

Assisted-by: Claude

* itertools: reserve the combination indices fallibly

`combinations` and `combinations_with_replacement` built their index vector
with an infallible allocation, so an `r` that passes the ssize_t check but
does not fit in memory aborted the process instead of raising MemoryError.

Assisted-by: Claude

* Apply the struct sequence constructor's dict argument

`structseq(sequence, dict)` discarded its second argument, so the hidden
fields past `n_sequence_fields` — `tm_zone`, `st_atime` and friends — were
always None when constructed directly or restored from a `(sequence, dict)`
pickle, and a non-dict second argument was accepted silently.

Take the dict, require it to be a dict, and fill the hidden slots the
sequence did not cover from it. A key that names a field the sequence
already supplied, or no field at all, is now a
"got duplicate or unexpected field name(s)" TypeError instead of being
dropped. Both arguments are bindable by name, as `sequence` and `dict`.

`os.stat_result` and `os.statvfs_result` did not accept a second argument
at all; they and `time.struct_time` now share the parsing.

Assisted-by: Claude

* _imp: report the argument count in find_frozen's arity error

Assisted-by: Claude

* Add regression tests for the reproduced crashers

One case per catalog entry, each asserting the behavior the fix produces:
recursion guards, the memory-unsafety sites, the overflow and unbounded
allocation guards, the eager-collection rejections, the unwrap sites, and
the cycles the collector now breaks. Every expected value was checked
against CPython 3.14.

Assisted-by: Claude

* Tolerate a changed-size RuntimeError in the set repr stress test

The mutator and reader threads race on purpose; a "changed size during
iteration" RuntimeError is a valid outcome of that race and should not fail
the test. The panic it guards against is not.

Assisted-by: Claude

* Move the crash regression tests into per-module snippets

crash_regressions.py collected every reproduced crasher in one file. Split it
into the snippet for the module each case exercises, and add stdlib_gc.py,
stdlib_asyncio.py, stdlib_lzma.py, stdlib_threading_set_repr.py and
stdlib_threading_itertools_cycle.py for the cases with no existing home.

The suite runs every snippet under the host CPython too, so the checks only
RustPython raises are guarded by sys.implementation.name: the hash and
__parameters__ recursion depth, and the deque repeat overflow. The float
ctypes argument accepts either TypeError or ctypes.ArgumentError.

Assisted-by: Claude
2026-08-14 00:57:10 +09:00

413 lines
10 KiB
Python

import builtins
import itertools
import pickle
import platform
import sys
def exceptions_eq(e1, e2):
return type(e1) is type(e2) and e1.args == e2.args
def round_trip_repr(e):
return exceptions_eq(e, eval(repr(e)))
# KeyError
empty_exc = KeyError()
assert str(empty_exc) == ""
assert round_trip_repr(empty_exc)
assert len(empty_exc.args) == 0
assert type(empty_exc.args) == tuple
exc = KeyError("message")
assert str(exc) == "'message'"
assert round_trip_repr(exc)
assert LookupError.__str__(exc) == "message"
exc = KeyError("message", "another message")
assert str(exc) == "('message', 'another message')"
assert round_trip_repr(exc)
assert exc.args[0] == "message"
assert exc.args[1] == "another message"
class A:
def __repr__(self):
return "A()"
def __str__(self):
return "str"
def __eq__(self, other):
return type(other) is A
exc = KeyError(A())
assert str(exc) == "A()"
assert round_trip_repr(exc)
# ImportError / ModuleNotFoundError
exc = ImportError()
assert exc.name is None
assert exc.path is None
assert exc.msg is None
assert exc.args == ()
exc = ImportError("hello")
assert exc.name is None
assert exc.path is None
assert exc.msg == "hello"
assert exc.args == ("hello",)
exc = ImportError("hello", name="name", path="path")
assert exc.name == "name"
assert exc.path == "path"
assert exc.msg == "hello"
assert exc.args == ("hello",)
class NewException(Exception):
def __init__(self, value):
self.value = value
try:
raise NewException("test")
except NewException as e:
assert e.value == "test"
exc = SyntaxError("msg", 1, 2, 3, 4, 5)
assert exc.msg == "msg"
assert exc.filename is None
assert exc.lineno is None
assert exc.offset is None
assert exc.text is None
err = SyntaxError("bad bad", ("bad.py", 1, 2, "abcdefg"))
err.msg = "changed"
assert err.msg == "changed"
assert str(err) == "changed (bad.py, line 1)"
del err.msg
assert err.msg is None
# Regression to:
# https://github.com/RustPython/RustPython/issues/2779
class MyError(Exception):
pass
e = MyError("message")
try:
raise e from e
except MyError as exc:
# It was a segmentation fault before, will print info to stdout:
sys.excepthook(type(exc), exc, exc.__traceback__)
assert isinstance(exc, MyError)
assert exc.__cause__ is e
assert exc.__context__ is None
else:
assert False, "exception not raised"
try:
raise ValueError("test") from e
except ValueError as exc:
sys.excepthook(type(exc), exc, exc.__traceback__) # ok, will print two excs
assert isinstance(exc, ValueError)
assert exc.__cause__ is e
assert exc.__context__ is None
else:
assert False, "exception not raised"
# New case:
# potential recursion on `__context__` field
e = MyError("message")
try:
try:
raise e
except MyError as exc:
raise e
else:
assert False, "exception not raised"
except MyError as exc:
sys.excepthook(type(exc), exc, exc.__traceback__)
assert exc.__cause__ is None
assert exc.__context__ is None
else:
assert False, "exception not raised"
e = MyError("message")
try:
try:
raise e
except MyError as exc:
raise exc
else:
assert False, "exception not raised"
except MyError as exc:
sys.excepthook(type(exc), exc, exc.__traceback__)
assert exc.__cause__ is None
assert exc.__context__ is None
else:
assert False, "exception not raised"
e = MyError("message")
try:
try:
raise e
except MyError as exc:
raise e from e
else:
assert False, "exception not raised"
except MyError as exc:
sys.excepthook(type(exc), exc, exc.__traceback__)
assert exc.__cause__ is e
assert exc.__context__ is None
else:
assert False, "exception not raised"
e = MyError("message")
try:
try:
raise e
except MyError as exc:
raise exc from e
else:
assert False, "exception not raised"
except MyError as exc:
sys.excepthook(type(exc), exc, exc.__traceback__)
assert exc.__cause__ is e
assert exc.__context__ is None
else:
assert False, "exception not raised"
# New case:
# two exception in a recursion loop
class SubError(MyError):
pass
e = MyError("message")
d = SubError("sub")
try:
raise e from d
except MyError as exc:
# It was a segmentation fault before, will print info to stdout:
sys.excepthook(type(exc), exc, exc.__traceback__)
assert isinstance(exc, MyError)
assert exc.__cause__ is d
assert exc.__context__ is None
else:
assert False, "exception not raised"
e = MyError("message")
try:
raise d from e
except SubError as exc:
# It was a segmentation fault before, will print info to stdout:
sys.excepthook(type(exc), exc, exc.__traceback__)
assert isinstance(exc, SubError)
assert exc.__cause__ is e
assert exc.__context__ is None
else:
assert False, "exception not raised"
# New case:
# explicit `__context__` manipulation.
e = MyError("message")
e.__context__ = e
try:
raise e
except MyError as exc:
# It was a segmentation fault before, will print info to stdout:
sys.excepthook(type(exc), exc, exc.__traceback__)
assert isinstance(exc, MyError)
assert exc.__cause__ is None
assert exc.__context__ is e
# Regression to
# https://github.com/RustPython/RustPython/issues/2771
# `BaseException` and `Exception`:
assert BaseException.__new__.__qualname__ == "BaseException.__new__"
assert BaseException.__init__.__qualname__ == "BaseException.__init__"
assert BaseException().__dict__ == {}
# Exception inherits __init__ from BaseException
assert Exception.__new__.__qualname__ == "Exception.__new__", (
Exception.__new__.__qualname__
)
assert Exception.__init__.__qualname__ == "BaseException.__init__", (
Exception.__init__.__qualname__
)
assert Exception().__dict__ == {}
# Extends `BaseException`, simple - inherits __init__ from BaseException:
assert KeyboardInterrupt.__new__.__qualname__ == "KeyboardInterrupt.__new__", (
KeyboardInterrupt.__new__.__qualname__
)
assert KeyboardInterrupt.__init__.__qualname__ == "BaseException.__init__"
assert KeyboardInterrupt().__dict__ == {}
# Extends `BaseException`, complex - has its own __init__:
# SystemExit_init sets self.code based on args length
assert SystemExit.__init__.__qualname__ == "SystemExit.__init__"
assert SystemExit.__dict__.get("__init__") is not None, (
"SystemExit must have its own __init__"
)
assert SystemExit.__init__ is not BaseException.__init__
assert SystemExit().__dict__ == {}
# SystemExit.code behavior:
assert SystemExit().code is None
assert SystemExit(1).code == 1
assert SystemExit(1, 2).code == (1, 2)
assert SystemExit(1, 2, 3).code == (1, 2, 3)
# Extends `Exception`, simple - inherits __init__ from BaseException:
assert TypeError.__new__.__qualname__ == "TypeError.__new__"
assert TypeError.__init__.__qualname__ == "BaseException.__init__"
assert TypeError().__dict__ == {}
# Extends `Exception`, complex:
assert OSError.__new__.__qualname__ == "OSError.__new__"
assert OSError.__init__.__qualname__ == "OSError.__init__"
assert OSError().__dict__ == {}
assert OSError.errno
assert OSError.strerror
assert OSError(1, 2).errno
assert OSError(1, 2).strerror
# OSError Unexpected number of arguments
w = OSError()
assert w.errno == None
assert not sys.platform.startswith("win") or w.winerror == None
assert w.strerror == None
assert w.filename == None
assert w.filename2 == None
assert str(w) == ""
x = pickle.loads(pickle.dumps(w, 4))
assert type(w) == type(x)
assert x.errno == None
assert not sys.platform.startswith("win") or x.winerror == None
assert x.strerror == None
assert x.filename == None
assert x.filename2 == None
assert str(x) == ""
w = OSError(0)
assert w.errno == None
assert not sys.platform.startswith("win") or w.winerror == None
assert w.strerror == None
assert w.filename == None
assert w.filename2 == None
assert str(w) == "0"
x = pickle.loads(pickle.dumps(w, 4))
assert type(w) == type(x)
assert x.errno == None
assert not sys.platform.startswith("win") or x.winerror == None
assert x.strerror == None
assert x.filename == None
assert x.filename2 == None
assert str(x) == "0"
w = OSError("foo")
assert w.errno == None
assert not sys.platform.startswith("win") or w.winerror == None
assert w.strerror == None
assert w.filename == None
assert w.filename2 == None
assert str(w) == "foo"
x = pickle.loads(pickle.dumps(w, 4))
assert type(w) == type(x)
assert x.errno == None
assert not sys.platform.startswith("win") or x.winerror == None
assert x.strerror == None
assert x.filename == None
assert x.filename2 == None
assert str(x) == "foo"
w = OSError("a", "b", "c", "d", "e", "f")
assert w.errno == None
assert not sys.platform.startswith("win") or w.winerror == None
assert w.strerror == None
assert w.filename == None
assert w.filename2 == None
assert str(w) == "('a', 'b', 'c', 'd', 'e', 'f')"
x = pickle.loads(pickle.dumps(w, 4))
assert type(w) == type(x)
assert x.errno == None
assert not sys.platform.startswith("win") or x.winerror == None
assert x.strerror == None
assert x.filename == None
assert x.filename2 == None
assert str(x) == "('a', 'b', 'c', 'd', 'e', 'f')"
# Custom `__new__` and `__init__`:
assert ImportError.__init__.__qualname__ == "ImportError.__init__"
assert ImportError(name="a").name == "a"
# ModuleNotFoundError inherits __init__ from ImportError via MRO (MiddlingExtendsException)
assert ModuleNotFoundError.__init__.__qualname__ == "ImportError.__init__"
assert ModuleNotFoundError(name="a").name == "a"
# Check that all exceptions have string `__doc__`:
for exc in filter(
lambda obj: isinstance(obj, BaseException),
vars(builtins).values(),
):
assert isinstance(exc.__doc__, str)
# except* handling should normalize non-group exceptions
try:
raise ValueError("x")
except* ValueError as err:
assert isinstance(err, ExceptionGroup)
assert len(err.exceptions) == 1
assert isinstance(err.exceptions[0], ValueError)
assert err.exceptions[0].args == ("x",)
else:
assert False, "except* handler did not run"
# The exceptions argument is a sequence, so an arbitrary iterable must be
# rejected rather than drained.
try:
ExceptionGroup("m", itertools.count())
except TypeError:
pass
else:
assert False, "ExceptionGroup accepted an unbounded iterable"
# ImportError.__reduce__ has to cope with the exception carrying no args.
assert pickle.loads(pickle.dumps(ImportError())).args == ()
restored = pickle.loads(pickle.dumps(ImportError("m", name="n", path="p")))
assert restored.args == ("m",)
assert restored.name == "n"
assert restored.path == "p"