8000 compiling an AST with an invalid TypeAlias causes a segmentation fault · Issue #109341 · python/cpython · GitHub
[go: up one dir, main page]
Skip to content

compiling an AST with an invalid TypeAlias causes a segmentation fault #109341

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
15r10nk opened this issue Sep 12, 2023 · 3 comments
Closed

compiling an AST with an invalid TypeAlias causes a segmentation fault #109341

15r10nk opened this issue Sep 12, 2023 · 3 comments
Assignees
@JelleZijlstra
Labels
3.12 only security fixes 3.13 bugs and security fixes topic-typing type-crash A hard crash of the interpreter, possibly with a core dump

Comments

@15r10nk
Copy link
Contributor
15r10nk commented Sep 12, 2023 •
edited by bedevere-app bot
Loading

Bug report

Bug description:

The code for the following AST is:

type foo['x'] = Callable

compiling the AST for the given code results in a segmentation fault

from ast import *

m = Module(
    body=[
        TypeAlias(
            name=Subscript(
                value=Name(id="foo", ctx=Load()),
                slice=Constant(value="x"),
                ctx=Store(),
            ),
            type_params=[],
            value=Name(id="Callable", ctx=Load()),
        )
    ],
    type_ignores=[],
)

compile(fix_missing_locations(m), "<file>", "exec")

output (Python 3.12.0rc2+):

fish: Job 1, 'venv3.12/bin/python bug.py' terminated by signal SIGSEGV (Adressbereichsfehler)

Compiling the code gives the correct syntax error.

compile("type foo['x'] = Callable","<file>","exec")

output (Python 3.12.0rc2+):

Traceback (most recent call last):
  File "/home/frank/projects/executing/bug.py", line 1, in <module>
    compile("type foo['x'] = Callable","<file>","exec")
  File "<file>", line 1
    type foo['x'] = Callable
             ^^^
SyntaxError: invalid syntax

CPython versions tested on:

3.12

Operating systems tested on:

No response

Linked PRs
@15r10nk 15r10nk added the type-bug An unexpected behavior, bug, or error label Sep 12, 2023
@JelleZijlstra JelleZijlstra self-assigned this Sep 12, 2023
@AlexWaygood AlexWaygood added type-crash A hard crash of the interpreter, possibly with a core dump topic-typing 3.12 only security fixes 3.13 bugs and security fixes and removed type-bug An unexpected behavior, bug, or error labels Sep 12, 2023
@JelleZijlstra
Copy link
Member

I found a similar crash with the walrus:

m = ast.Module(
    body=[
        ast.Expr(
            value=ast.ListComp(
                elt=ast.NamedExpr(
                    target=ast.Constant(value=1),
                    value=ast.Constant(value=3),
                ),
                generators=[
                    ast.comprehension(
                        target=ast.Name(id="x", ctx=ast.Store()),
                        iter=ast.Name(id="y", ctx=ast.Load()),
                        ifs=[],
                        is_async=0,
                    )
                ],
            )
        )
    ],
    type_ignores=[],
)

with self.assertRaises(SyntaxError):
    compile(ast.fix_missing_locations(m), "<file>", "exec")

That one should be backported further though so I'll fix it separately.

JelleZijlstra added a commit to JelleZijlstra/cpython that referenced this issue Sep 12, 2023
@JelleZijlstra
pythongh-109341: Fix crash on compiling invalid AST including TypeAlias
a4844e1
JelleZijlstra added a commit to JelleZijlstra/cpython that referenced this issue Sep 12, 2023
@JelleZijlstra
pythongh-109341: Fix crash on compiling invalid AST including TypeAlias
8a459c7
@bedevere-app bedevere-app bot mentioned this issue Sep 12, 2023
Merged
@JelleZijlstra JelleZijlstra changed the title compiling an invalid AST causes a segmentation fault compiling an AST with an invalid TypeAlias causes a segmentation fault Sep 12, 2023
@JelleZijlstra
Copy link
Member

I found the other issue (now #109351) by looking for assert()s in Python/symtable.c that looked like they might be triggered by an invalid AST. I didn't see any others, but enough fuzzing might uncover more.

JelleZijlstra added a commit that referenced this issue Sep 13, 2023
@JelleZijlstra
gh-109341: Fix crash on compiling invalid AST including TypeAlias (#1…
987b4bc 
…09349)
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Sep 13, 2023
@JelleZijlstra @miss-islington
pythongh-109341: Fix crash on compiling invalid AST including TypeAli…
d5331e2 
…as (pythonGH-109349)

(cherry picked from commit 987b4bc)

Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com>
@bedevere-app bedevere-app bot mentioned this issue Sep 13, 2023
Merged
Yhg1s pushed a commit that referenced this issue Sep 14, 2023
@miss-islington @JelleZijlstra
[3.12] gh-109341: Fix crash on compiling invalid AST including TypeAl…
5c7e8c3 
…ias (GH-109349) (#109381)

gh-109341: Fix crash on compiling invalid AST including TypeAlias (GH-109349)
(cherry picked from commit 987b4bc)

Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com>
@JelleZijlstra
Copy link
Member

Merged and backported, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@JelleZijlstra JelleZijlstra

Labels
3.12 only security fixes 3.13 bugs and security fixes topic-typing type-crash A hard crash of the interpreter, possibly with a core dump
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@JelleZijlstra @15r10nk @AlexWaygood
0