From 7ab6125783f7ae70b2d90f1bc21e8122678131f6 Mon Sep 17 00:00:00 2001 From: manoj Date: Mon, 22 Jun 2026 22:03:42 +0530 Subject: [PATCH 1/2] Fix double free in _PyPegen_raise_error_known_location() --- .../2026-06-22-21-58-25.gh-issue-151763.FYc3_9.rst | 3 +++ Parser/pegen_errors.c | 1 + 2 files changed, 4 insertions(+) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-21-58-25.gh-issue-151763.FYc3_9.rst diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-21-58-25.gh-issue-151763.FYc3_9.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-21-58-25.gh-issue-151763.FYc3_9.rst new file mode 100644 index 00000000000000..7e65e03986cdb8 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-21-58-25.gh-issue-151763.FYc3_9.rst @@ -0,0 +1,3 @@ +Fix a possible double-free of ```PyObject* error_line``` in +```_PyPegen_raise_error_known_location``` in ```pegen_errors.c``` by +resetting it to ```NULL```. It now correctly raises MemoryError. diff --git a/Parser/pegen_errors.c b/Parser/pegen_errors.c index 312699415efd9a..353358d14f3c78 100644 --- a/Parser/pegen_errors.c +++ b/Parser/pegen_errors.c @@ -391,6 +391,7 @@ _PyPegen_raise_error_known_location(Parser *p, PyObject *errtype, } tmp = Py_BuildValue("(OnnNnn)", p->tok->filename, lineno, col_number, error_line, end_lineno, end_col_number); + error_line = NULL; if (!tmp) { goto error; } From 7fa8e4fae8d4165892c5aad2912edd0f177d3f50 Mon Sep 17 00:00:00 2001 From: manoj Date: Mon, 22 Jun 2026 22:25:49 +0530 Subject: [PATCH 2/2] Highlight MemoryError in News entry --- .../2026-06-22-21-58-25.gh-issue-151763.FYc3_9.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-21-58-25.gh-issue-151763.FYc3_9.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-21-58-25.gh-issue-151763.FYc3_9.rst index 7e65e03986cdb8..0b8ef5014424ed 100644 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-21-58-25.gh-issue-151763.FYc3_9.rst +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-21-58-25.gh-issue-151763.FYc3_9.rst @@ -1,3 +1,3 @@ Fix a possible double-free of ```PyObject* error_line``` in ```_PyPegen_raise_error_known_location``` in ```pegen_errors.c``` by -resetting it to ```NULL```. It now correctly raises MemoryError. +resetting it to ```NULL```. It now correctly raises ```MemoryError```.