From 762ad31fed5c18464e2c8069219a51cdfab43a35 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?tonghuaroot=20=28=E7=AB=A5=E8=AF=9D=29?= Date: Mon, 17 Aug 2026 00:07:02 +0800 Subject: [PATCH] gh-151895: Fix marshal.loads() crash on dict reference-tracking failure (GH-151896) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Loading a reference-tracked dictionary dereferenced a NULL pointer when the allocation that registers it for back-references failed under low memory. It now raises MemoryError, matching the tuple and list paths. (cherry picked from commit 5b96d3914767dc71cb21fd3448f5ded4fd85d957) Co-authored-by: tonghuaroot (童话) --- .../2026-06-22-11-05-56.gh-issue-151895.QQsjUQ.rst | 2 ++ Python/marshal.c | 3 +++ 2 files changed, 5 insertions(+) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-11-05-56.gh-issue-151895.QQsjUQ.rst diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-11-05-56.gh-issue-151895.QQsjUQ.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-11-05-56.gh-issue-151895.QQsjUQ.rst new file mode 100644 index 00000000000000..e17b340348b06b --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-11-05-56.gh-issue-151895.QQsjUQ.rst @@ -0,0 +1,2 @@ +Fixed a crash in :func:`marshal.loads` when an allocation failed while +loading a reference-tracked dictionary; it now raises :exc:`MemoryError`. diff --git a/Python/marshal.c b/Python/marshal.c index 25353f6e689624..603697e9081c59 100644 --- a/Python/marshal.c +++ b/Python/marshal.c @@ -1471,6 +1471,9 @@ r_object(RFILE *p) } if (type == TYPE_DICT) { R_REF(v); + if (v == NULL) { + break; + } } else { idx = r_ref_reserve(flag, p);