From 6366ff4b672a81ae572e679a4c49b68e3ddc47e9 Mon Sep 17 00:00:00 2001 From: sobolevn Date: Wed, 20 May 2026 16:27:55 +0300 Subject: [PATCH 1/2] [3.13] gh-150146: Fix NULL dereference in `_Py_subs_parameters` (GH-150147) (cherry picked from commit f621ba16b72510e1abc9646a844a632df4ac275c) Co-authored-by: sobolevn --- Lib/test/test_genericalias.py | 10 ++++++++-- .../2026-05-20-13-06-17.gh-issue-150146.i5m_SL.rst | 5 +++++ Objects/genericaliasobject.c | 3 +++ 3 files changed, 16 insertions(+), 2 deletions(-) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-05-20-13-06-17.gh-issue-150146.i5m_SL.rst diff --git a/Lib/test/test_genericalias.py b/Lib/test/test_genericalias.py index 00dc9251e0ee3b..8bd30a63765474 100644 --- a/Lib/test/test_genericalias.py +++ b/Lib/test/test_genericalias.py @@ -56,9 +56,8 @@ from queue import Queue, SimpleQueue from weakref import WeakSet, ReferenceType, ref import typing -from typing import Unpack +from typing import TypeVar, Unpack -from typing import TypeVar T = TypeVar('T') K = TypeVar('K') V = TypeVar('V') @@ -537,6 +536,13 @@ def test_del_iter(self): iter_x = iter(t) del iter_x + def test_gh150146(self): + # It used to crash: + for container in [memoryview, list, tuple]: + with self.subTest(container=container): + x = container[TypeVar("")] + with self.assertRaises(TypeError): + x[*typing.Mapping[..., ...]] class TypeIterationTests(unittest.TestCase): _UNITERABLE_TYPES = (list, tuple) diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-05-20-13-06-17.gh-issue-150146.i5m_SL.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-05-20-13-06-17.gh-issue-150146.i5m_SL.rst new file mode 100644 index 00000000000000..f373f0bee7023e --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-05-20-13-06-17.gh-issue-150146.i5m_SL.rst @@ -0,0 +1,5 @@ +Fix a crash on a complex type variable substitution. + +``from typing import TypeVar; memoryview[TypeVar("")][*typing.Mapping[..., +...]]`` used to fail due to missing ``NULL`` check on ``_unpack_args`` C +function call. diff --git a/Objects/genericaliasobject.c b/Objects/genericaliasobject.c index 30759ca0e0eb67..bbb4f77d4a9e3a 100644 --- a/Objects/genericaliasobject.c +++ b/Objects/genericaliasobject.c @@ -443,6 +443,9 @@ _Py_subs_parameters(PyObject *self, PyObject *args, PyObject *parameters, PyObje self); } item = _unpack_args(item); + if (item == NULL) { + return NULL; + } for (Py_ssize_t i = 0; i < nparams; i++) { PyObject *param = PyTuple_GET_ITEM(parameters, i); PyObject *prepare, *tmp; From 890cc59b50f6c18697d2b14b2d427b169989ee8f Mon Sep 17 00:00:00 2001 From: sobolevn Date: Wed, 20 May 2026 16:42:16 +0300 Subject: [PATCH 2/2] Update Lib/test/test_genericalias.py --- Lib/test/test_genericalias.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Lib/test/test_genericalias.py b/Lib/test/test_genericalias.py index 8bd30a63765474..685bddfba70afe 100644 --- a/Lib/test/test_genericalias.py +++ b/Lib/test/test_genericalias.py @@ -538,7 +538,7 @@ def test_del_iter(self): def test_gh150146(self): # It used to crash: - for container in [memoryview, list, tuple]: + for container in [list, tuple]: with self.subTest(container=container): x = container[TypeVar("")] with self.assertRaises(TypeError):