Segmentation fault after deleting __fields__ attribute from ast.AST

Crash report

What happened?

>>> import ast
>>> dir(ast.AST)
['__class__', '__delattr__', '__dict__', '__dir__', '__doc__', '__eq__', '__format__', '__ge__', '__getattribute__', '__gt__', '__hash__', '__init__', '__init_subclass__', '__le__', '__lt__', '__match_args__', '__module__', '__ne__', '__new__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__sizeof__', '__str__', '__subclasshook__', '_attributes', '_fields']
>>> del ast.AST._fields
>>> dir(ast.AST)
['__class__', '__delattr__', '__dict__', '__dir__', '__doc__', '__eq__', '__format__', '__ge__', '__getattribute__', '__gt__', '__hash__', '__init__', '__init_subclass__', '__le__', '__lt__', '__match_args__', '__module__', '__ne__', '__new__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__sizeof__', '__str__', '__subclasshook__', '_attributes']
>>> t = ast.AST(arg1=123)
Segmentation fault

This happens because fields variable is null-pointer here, moreover it was previously checked for null here.

CPython versions tested on:

3.11

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.11.9 (main, Oct 28 2024, 23:26:29) [GCC 13.2.0]

Linked PRs

@Eclips4

cc @Eclips4 @JelleZijlstra (Would adding Py_TPFLAGS_IMMUTABLETYPE work or is it too restrictive?)

I can confirm, that this still happens on main:

Python 3.14.0a1+ (heads/main:19e93e2e269, Oct 28 2024, 11:42:01) [Clang 15.0.0 (clang-1500.3.9.4)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import ast
>>> del ast.AST._fields
>>> t = ast.AST(arg1=123)
[1]    85885 segmentation fault  ./python.exe

Py_TPFLAGS_IMMUTABLETYPE

I think that this is an overkill and it change the semantics here. We can just modify the code and check for NULL explicitly.

See

cpython/Parser/asdl_c.py

Line 877 in 9b14083

ast_type_init(PyObject *self, PyObject *args, PyObject *kw)

Oh yes, we only need to modify:

    if (PyObject_GetOptionalAttr((PyObject*)Py_TYPE(self), state->_fields, &fields) < 0) {
        goto cleanup;
    }

with a NULL check beforehand I think. What do you think?

pythongh-126105: Fix crash in `ast` module, when `._fields` is deleted

@Eclips4

cc @Eclips4 @JelleZijlstra (Would adding Py_TPFLAGS_IMMUTABLETYPE work or is it too restrictive?)

If you are talking about making nodes immutable, we can't do that because a lot of code relies on the fact that nodes are mutable. So it would be a huge breaking change.

gh-126105: Fix crash in `ast` module, when `._fields` is deleted (#12…

pythongh-126105: Fix crash in `ast` module, when `._fields` is deleted (

[3.12] pythongh-126105: Fix crash in `ast` module, when `._fields` is…

[3.13] gh-126105: Fix crash in `ast` module, when `._fields` is delet…

[3.12] gh-126105: Fix crash in `ast` module, when `._fields` is delet… (

Thank you Valery for the report and Nikita for the fix.

pythongh-126105: Fix crash in `ast` module, when `._fields` is deleted (

Navigation Menu

Repository navigation

Segmentation fault after deleting fields attribute from ast.AST #126105

Crash report

What happened?

CPython versions tested on:

Operating systems tested on:

Output from running 'python -VV' on the command line:

Linked PRs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Segmentation fault after deleting __fields__ attribute from ast.AST #126105

Description

Crash report

What happened?

CPython versions tested on:

Operating systems tested on:

Output from running 'python -VV' on the command line:

Linked PRs

Activity

picnixz commented on Oct 29, 2024

sobolevn commented on Oct 29, 2024

picnixz commented on Oct 29, 2024

Eclips4 commented on Oct 29, 2024

Eclips4 commented on Oct 29, 2024

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

Segmentation fault after deleting fields attribute from ast.AST #126105