gh-159739: Keep generic alias arguments alive while formatting errors (#159981)

When a generic alias contains a list of parameters and an object claiming to be an unpacked type-variable tuple returns a non-tuple from `__typing_subst__`, the error path frees the temporary argument tuple before reading it to format a `TypeError`. That use-after-free can crash the interpreter instead of reporting the invalid substitution.
This commit is contained in:
Jelle Zijlstra authored and GitHub committed 2026-10-20 21:33:19 -07:00
1 parent ebce4b70bf
commit 9c649dbaa8
2 files changed
+4 -3

No files matched your search

@@ -0,0 +1 @@
Fix a crash when constructing an error for invalid generic alias arguments.
+3 -3
View File
@@ -550,13 +550,13 @@ _Py_subs_parameters(PyObject *self, PyObject *args, PyObject *parameters, PyObje
}
if (unpack) {
if (!PyTuple_Check(arg)) {
Py_DECREF(newargs);
Py_DECREF(item);
Py_XDECREF(tuple_args);
PyObject *original = PyTuple_GET_ITEM(args, iarg);
PyErr_Format(PyExc_TypeError,
"expected __typing_subst__ of %T objects to return a tuple, not %T",
original, arg);
Py_DECREF(newargs);
Py_DECREF(item);
Py_XDECREF(tuple_args);
Py_DECREF(arg);
return NULL;
}