Skip to content

gh-155376: prevent supercheck NULL dereference - #155379

Open
BHUVANSH855 wants to merge 3 commits into
python:mainfrom
BHUVANSH855:audit-finding-2-super-new
Open

gh-155376: prevent supercheck NULL dereference#155379
BHUVANSH855 wants to merge 3 commits into
python:mainfrom
BHUVANSH855:audit-finding-2-super-new

Conversation

@BHUVANSH855

Copy link
Copy Markdown
Contributor

Summary

Fix a NULL dereference in supercheck() when an uninitialized super object is used as a descriptor.

What happened?

super.__new__(super) can create a super object whose internal type field is NULL. When that object is subsequently used through __get__(), supercheck() receives the NULL type pointer.

The error-handling path in supercheck() eventually formats an error message using type->tp_name, causing a NULL pointer dereference and a segmentation fault.

Fix

This change:

  • Adds an explicit NULL check for type in supercheck().
  • Raises TypeError("super object has no type") instead of dereferencing the NULL pointer.
  • Uses tp_alloc() directly in super_descr_get() for the internal super object allocation.
  • Adds a regression test for the uninitialized super case.
  • Adds a NEWS entry documenting the crash fix.

Reproducer

Before this change:

s = super.__new__(super)
s.__get__(1)

resulted in:

Segmentation fault (core dumped)

After this change:

TypeError: super object has no type

Tests

./python -m test test_super — passed
./python -m test test_super test_descr — passed
git diff --check — passed

Closes issue gh-155376

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant