Skip to content

specialized PRECALL opcodes don't check types #92063

Closed
@sweeneyde

Description

@sweeneyde

On the main branch, on both Windows and Linux, this crashes:

class Thing:
    pass

thing = Thing()

for i in range(10):
    print(i)
    try:
        str.upper(thing)
    except TypeError:
        pass

print("ok")

Other methods like str.split, bytes.split, and list.sort fail similarly. I caught this by running

./python -m test test_descr -m test_proxy_call -R3:20

Looking through stack traces, it appears the failure is on the res = cfunc(...) call in PRECALL_METHOD_DESCRIPTOR_FAST_WITH_KEYWORDS instruction. It looks to be a 3.11-only bug.

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.11only security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)release-blockertype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions