Skip to content

NULL pointer dereference in _Py_TYPE_impl with fuzzed code #150146

@correctmost

Description

@correctmost

Crash report

What happened?

Python crashes when running this fuzzed code:

from typing import Mapping, TypeVar

x = memoryview[TypeVar("")]
x[*Mapping[..., ...]]
AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x55cc81a1f7cd bp 0x7ffe32df6410 sp 0x7ffe32df6170 T0)
The signal is caused by a READ memory access.
Hint: address points to the zero page.
    #0 0x55cc81a1f7cd in _Py_TYPE_impl Include/object.h:234
    #1 0x55cc81a1f7cd in _Py_subs_parameters Objects/genericaliasobject.c:423
    #2 0x55cc81a27c5d in ga_getitem Objects/genericaliasobject.c:586
    #3 0x55cc818c7ed8 in PyObject_GetItem Objects/abstract.c:163
    #4 0x55cc821cd7c0 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:65
    #5 0x55cc82251d84 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
    #6 0x55cc82251d84 in _PyEval_Vector Python/ceval.c:2156
    #7 0x55cc82251d84 in PyEval_EvalCode Python/ceval.c:686
    #8 0x55cc824dd853 in run_mod Python/pythonrun.c:1472
    #9 0x55cc824e7a7b in pyrun_file Python/pythonrun.c:1296
    #10 0x55cc824e7a7b in _PyRun_SimpleFileObject Python/pythonrun.c:518
    #11 0x55cc824e8cfc in _PyRun_AnyFileObject Python/pythonrun.c:81
    #12 0x55cc825e8ac7 in pymain_run_file_obj Modules/main.c:411
    #13 0x55cc825e8ac7 in pymain_run_file Modules/main.c:430
    #14 0x55cc825e8ac7 in pymain_run_python Modules/main.c:715
    #15 0x55cc825ec2bd in Py_RunMain Modules/main.c:796
    #16 0x55cc825ec2bd in pymain_main Modules/main.c:826
    #17 0x55cc825ec2bd in Py_BytesMain Modules/main.c:850

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.16.0a0 (heads/main:d948eaa3660, May 20 2026, 05:08:21) [GCC 16.1.1 20260430]

Linked PRs

Metadata

Metadata

Assignees

Labels

interpreter-core(Objects, Python, Grammar, and Parser dirs)topic-typingtype-crashA hard crash of the interpreter, possibly with a core dump
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions