From c954f91f324478f5bde4e482d43047d2b8171f5b Mon Sep 17 00:00:00 2001 From: Prakash Sellathurai Date: Tue, 7 Apr 2026 20:16:59 +0530 Subject: [PATCH 01/10] Add Add NULL check and fallback to ga_vectorcall --- Objects/genericaliasobject.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/Objects/genericaliasobject.c b/Objects/genericaliasobject.c index 7aef56cf4e93b8..393df775ed5bad 100644 --- a/Objects/genericaliasobject.c +++ b/Objects/genericaliasobject.c @@ -650,7 +650,14 @@ ga_vectorcall(PyObject *self, PyObject *const *args, size_t nargsf, PyObject *kwnames) { gaobject *alias = (gaobject *) self; - PyObject *obj = PyVectorcall_Function(alias->origin)(alias->origin, args, nargsf, kwnames); + vectorcallfunc origin_vectorcall = PyVectorcall_Function(alias->origin); + PyObject *obj; + if (origin_vectorcall != NULL) { + obj = origin_vectorcall(alias->origin, args, nargsf, kwnames); + } else { + /* Fallback to generic call path*/ + obj = PyObject_Vectorcall(alias->origin, args, nargsf, kwnames); + } return set_orig_class(obj, self); } From 01faae21b34912bffe4c376a736c9d5b2827dfa7 Mon Sep 17 00:00:00 2001 From: Prakash Sellathurai Date: Tue, 7 Apr 2026 20:19:30 +0530 Subject: [PATCH 02/10] Add Null check to _Py_make_parameters when_PyTuple_Resize fails and parameter is null --- Objects/genericaliasobject.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Objects/genericaliasobject.c b/Objects/genericaliasobject.c index 393df775ed5bad..7bc4d275bbb4b7 100644 --- a/Objects/genericaliasobject.c +++ b/Objects/genericaliasobject.c @@ -242,7 +242,7 @@ _Py_make_parameters(PyObject *args) len += needed; if (_PyTuple_Resize(¶meters, len) < 0) { Py_DECREF(subparams); - Py_DECREF(parameters); + Py_XDECREF(parameters); Py_XDECREF(tuple_args); return NULL; } From 31b5522ea8fa8ae86b79db4d36b3bc53dd0e214c Mon Sep 17 00:00:00 2001 From: Prakash Sellathurai Date: Tue, 7 Apr 2026 20:38:05 +0530 Subject: [PATCH 03/10] add changelog --- .../2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst new file mode 100644 index 00000000000000..633db646b2d72b --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst @@ -0,0 +1,2 @@ +1. Add Add NULL check and fallback to ga_vectorcall +2. Add Null check to _Py_make_parameters when_PyTuple_Resize fails and parameter is null From e6a5d95c6ea4bcc17af4c7eae6d0235560b4c779 Mon Sep 17 00:00:00 2001 From: Prakash Sellathurai Date: Tue, 7 Apr 2026 20:46:30 +0530 Subject: [PATCH 04/10] style: fix liting error --- Objects/genericaliasobject.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/Objects/genericaliasobject.c b/Objects/genericaliasobject.c index 7bc4d275bbb4b7..42e63d6e8c0876 100644 --- a/Objects/genericaliasobject.c +++ b/Objects/genericaliasobject.c @@ -650,12 +650,12 @@ ga_vectorcall(PyObject *self, PyObject *const *args, size_t nargsf, PyObject *kwnames) { gaobject *alias = (gaobject *) self; - vectorcallfunc origin_vectorcall = PyVectorcall_Function(alias->origin); - PyObject *obj; - if (origin_vectorcall != NULL) { - obj = origin_vectorcall(alias->origin, args, nargsf, kwnames); - } else { - /* Fallback to generic call path*/ + vectorcallfunc origin_vectorcall = PyVectorcall_Function(alias->origin); + PyObject *obj; + if (origin_vectorcall != NULL) { + obj = origin_vectorcall(alias->origin, args, nargsf, kwnames); + } else { + /* Fallback to generic call path*/ obj = PyObject_Vectorcall(alias->origin, args, nargsf, kwnames); } return set_orig_class(obj, self); From 1defe5da55126f10deccfdfad21f62ec07adfc8a Mon Sep 17 00:00:00 2001 From: Prakash Sellathurai Date: Wed, 8 Apr 2026 19:41:55 +0530 Subject: [PATCH 05/10] remove reduntant Py_XDECREF(param) call in genricalias object call --- Objects/genericaliasobject.c | 1 - 1 file changed, 1 deletion(-) diff --git a/Objects/genericaliasobject.c b/Objects/genericaliasobject.c index 42e63d6e8c0876..d4149b826e2d95 100644 --- a/Objects/genericaliasobject.c +++ b/Objects/genericaliasobject.c @@ -242,7 +242,6 @@ _Py_make_parameters(PyObject *args) len += needed; if (_PyTuple_Resize(¶meters, len) < 0) { Py_DECREF(subparams); - Py_XDECREF(parameters); Py_XDECREF(tuple_args); return NULL; } From 99b1ce92a3e931421990d54d7906f0a4a4f36ee6 Mon Sep 17 00:00:00 2001 From: Prakash Sellathurai Date: Wed, 8 Apr 2026 19:53:50 +0530 Subject: [PATCH 06/10] remove redunatnt PyVectorcall_Function call in generic alias object c --- Objects/genericaliasobject.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/Objects/genericaliasobject.c b/Objects/genericaliasobject.c index d4149b826e2d95..e3bc8eb2739e3f 100644 --- a/Objects/genericaliasobject.c +++ b/Objects/genericaliasobject.c @@ -649,14 +649,7 @@ ga_vectorcall(PyObject *self, PyObject *const *args, size_t nargsf, PyObject *kwnames) { gaobject *alias = (gaobject *) self; - vectorcallfunc origin_vectorcall = PyVectorcall_Function(alias->origin); - PyObject *obj; - if (origin_vectorcall != NULL) { - obj = origin_vectorcall(alias->origin, args, nargsf, kwnames); - } else { - /* Fallback to generic call path*/ - obj = PyObject_Vectorcall(alias->origin, args, nargsf, kwnames); - } + PyObject *obj = PyObject_Vectorcall(alias->origin, args, nargsf, kwnames); return set_orig_class(obj, self); } From b93f0bf4558cc174ecfd33e834b14fc76a21c3f4 Mon Sep 17 00:00:00 2001 From: Prakash Sellathurai Date: Wed, 8 Apr 2026 20:08:15 +0530 Subject: [PATCH 07/10] Update 2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst --- .../2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst index 633db646b2d72b..cba24ff15ede03 100644 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst @@ -1,2 +1,2 @@ -1. Add Add NULL check and fallback to ga_vectorcall -2. Add Null check to _Py_make_parameters when_PyTuple_Resize fails and parameter is null +1. Fix NULL dereference bug in ga_vectorcall by using PyObject_Vectorcall() instead of calling PyVectorcall_Function(). +2. Remove the redundant Py_XDECREF call in _Py_make_parameters From a3ad3ef96307c7c813486c50f2389be56b18d593 Mon Sep 17 00:00:00 2001 From: Prakash Sellathurai Date: Mon, 13 Apr 2026 23:40:22 +0530 Subject: [PATCH 08/10] Update 2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst --- .../2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst index cba24ff15ede03..26a55854856a89 100644 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst @@ -1,2 +1 @@ -1. Fix NULL dereference bug in ga_vectorcall by using PyObject_Vectorcall() instead of calling PyVectorcall_Function(). -2. Remove the redundant Py_XDECREF call in _Py_make_parameters +Fix vectorcall support in types.GenericAlias when the underlying type does not support the vectorcall protocol. Fix possible leaks in types.GenericAlias and types.UnionType in case of memory error. From 3a78f4537ff1f0b9334afb6db335aee468f5c8fc Mon Sep 17 00:00:00 2001 From: Prakash Sellathurai Date: Tue, 14 Apr 2026 12:48:40 +0530 Subject: [PATCH 09/10] Update 2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst --- .../2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst | 2 +- tmp/crash_test.py | 8 ++++++++ 2 files changed, 9 insertions(+), 1 deletion(-) create mode 100644 tmp/crash_test.py diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst index 26a55854856a89..2c273fc4daba3d 100644 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-04-07-20-37-23.gh-issue-148222.uF4D4E.rst @@ -1 +1 @@ -Fix vectorcall support in types.GenericAlias when the underlying type does not support the vectorcall protocol. Fix possible leaks in types.GenericAlias and types.UnionType in case of memory error. +Fix vectorcall support in :class:`types.GenericAlias` when the underlying type does not support the vectorcall protocol. Fix possible leaks in :class:`types.GenericAlias` and :class:`types.UnionType` in case of memory error. diff --git a/tmp/crash_test.py b/tmp/crash_test.py new file mode 100644 index 00000000000000..f60832ee3e0c35 --- /dev/null +++ b/tmp/crash_test.py @@ -0,0 +1,8 @@ +import types, ctypes +class NoVectorCall: + def __class_getitem__(cls, item): + return types.GenericAlias(cls, item) + def __new__(cls, x): + return x * 2 + +print(hasattr(NoVectorCall, "__vectorcalloffset__")) \ No newline at end of file From 60378b068869746598dcb14ff2243179c027eb71 Mon Sep 17 00:00:00 2001 From: Prakash Sellathurai Date: Tue, 14 Apr 2026 21:49:29 +0530 Subject: [PATCH 10/10] Delete crash_test.py --- tmp/crash_test.py | 8 -------- 1 file changed, 8 deletions(-) delete mode 100644 tmp/crash_test.py diff --git a/tmp/crash_test.py b/tmp/crash_test.py deleted file mode 100644 index f60832ee3e0c35..00000000000000 --- a/tmp/crash_test.py +++ /dev/null @@ -1,8 +0,0 @@ -import types, ctypes -class NoVectorCall: - def __class_getitem__(cls, item): - return types.GenericAlias(cls, item) - def __new__(cls, x): - return x * 2 - -print(hasattr(NoVectorCall, "__vectorcalloffset__")) \ No newline at end of file