René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"NULL ptr deref in _PyCode_ConstantKey when compiling code","articleBody":"# Crash report\n\n### What happened?\n\nUnfortunately it's a slightly large minimal reproducer. You can use `xxd -r` to go from the hexdump to the actual binary.\n\n```\n~/p/cpython ❯❯❯ xxd ~/Downloads/clusterfuzz-testcase-minimized-fuzz_pycompile-5092056728403968 \n00000000: 5c62 2320 2323 2063 6f64 696e 673a 206c  \\b# ## coding: l\n00000010: 6174 696e 332f 30ff ffff ffff ffff ff6c  atin3/0........l\n00000020: 6174 696e 37ff ffff 6463 6173 6564 6464  atin7...dcaseddd\n00000030: 6464 6479 2e62 6b0a 0a0a 0a63 6c61 7373  dddy.bk....class\n00000040: 2069 6e32 2829 3a0a 2020 2364 6464 6464   in2():.  #ddddd\n00000050: 6762 6b0a 0a20 2064 6464 6464 640a 0a0a  gbk..  dddddd...\n00000060: 476c 6174 762e 5f5f 7274 0a63 6c61 7373  Glatv.__rt.class\n00000070: 2069 6e32 28ba 293a 0a20 2064 6464 6464   in2(.):.  ddddd\n00000080: 6467 626c 0a0a 2020 636c 6173 7320 47ed  dgbl..  class G.\n00000090: 5b5f 7072 7765 616e 7065 725d 3a61 7464  [_prweanper]:atd\n000000a0: 6464 640a 0a0a 0a0a 0a0a 0a30 6f37 300a  ddd........0o70.\n000000b0: 0a0a 0a0a 0a0a 0a0a 7476 6147 6c2e 5f5f  ........tvaGl.__\n000000c0: 7274 0a63 6c61 7373 2069 6e32 28cf 293a  rt.class in2(.):\n000000d0: 0a20 2064 6464 6464 6467 626c 0a0a 2020  .  ddddddgbl..  \n000000e0: 636c 6173 7320 47ed 5b5f 7072 7765 616e  class G.[_prwean\n000000f0: 7065 725d 3a61 2564 6462 2320 6762 6c0a  per]:a%ddb# gbl.\n00000100: 0a20 2063 6c61 7373 2047 ed5b 5f70 7277  .  class G.[_prw\n00000110: 6561 6e70 6572 5d3a 6174 6464 6464 0a0a  eanper]:atdddd..\n00000120: 2320 636f 6469 6e67 3d6c 6174 696e 2d31  # coding=latin-1\n00000130: 0a0a 0a47 6c61 7476 2e5f 5f72 740a 636c  ...Glatv.__rt.cl\n00000140: 6173 7320 696e 3228 ba29 3a0a 2020 6464  ass in2(.):.  dd\n00000150: 6464 6464 6762 6c0a 0a20 2063 6c61 7373  ddddgbl..  class\n00000160: 2047 ed5b 5f5f 636c 6173 7364 6963 745f   G.[__classdict_\n00000170: 5f5d 3a61 7464 6464 640a 0a0a 0a0a 0a0a  _]:atdddd.......\n00000180: 0a30 6f37 300a 0a0a 0a0a 0a0a 0a0a 7476  .0o70.........tv\n00000190: 6147 6c2e 5f5f 7274 0a63 6c61 7373 2069  aGl.__rt.class i\n000001a0: 6e32 28cf 293a 0a20 2064 6464 6464 6467  n2(.):.  ddddddg\n000001b0: 626c 0a0a 2020 636c 6173 7320 47ed 5b5f  bl..  class G.[_\n000001c0: 7072 7765 616e 7065 725d 3a61 2564 6462  prweanper]:a%ddb\n000001d0: 2320 6762 6c0a 0a20 2063 6c61 7373 2047  # gbl..  class G\n000001e0: ed5b 5f70 7277 6561 6e70 6572 5d3a 6174  .[_prweanper]:at\n000001f0: 6464 6464 0a0a 2320 636f 2600 0000 0000  dddd..# co\u0026.....\n00000200: 0000 6469 6c67 3d6c 6174 696e 2d31 0a0a  ..dilg=latin-1..\n00000210: 0a47 6c61 7476 2e5f 5f72 740a 636c 6173  .Glatv.__rt.clas\n00000220: 7320 696e 3228 ba29 3a0a 2020 6464 6464  s in2(.):.  dddd\n00000230: 6464 6762 6c0a 0a20 2063 6c61 7373 2047  ddgbl..  class G\n00000240: ed5b 5f70 7277 6561 6e70 6572 5d3a 6174  .[_prweanper]:at\n00000250: 6464 6464 0aee 0a0a 0a0a 0a0a 306f 3730  dddd........0o70\n00000260: 0a0a 0a0a 0a0a 0a0a 0a47 6c61 7476 2e5f  .........Glatv._\n00000270: 5f72 740a 636c 6173 7320 696e 3228 cf29  _rt.class in2(.)\n00000280: 3a0a 2020 6464 6464 6464 6762 6c0a 0a20  :.  ddddddgbl.. \n00000290: 2063 6c61 7373 2047 ed5b 5f70 7277 6561   class G.[_prwea\n000002a0: 6e70 6572 5d3a 6125 6464 6223 2023 2320  nper]:a%ddb# ## \n000002b0: 636f 64ff ffff ff64 6464 6464 989b 86d1  cod....ddddd....\n000002c0: 9d94 f5f5 0a0a 636c 6173 7320 696e 3228  ......class in2(\n000002d0: 293a 6f37 300a 0a0a 0a0a 0a0a 0a40 476c  ):o70........@Gl\n000002e0: 6174 3a61 7464 6464 640a 0a0a 0a0a 0a0a  at:atdddd.......\n000002f0: 0a30 6f37 300a 0a0a 0a0a 0a0a 0a0a 476c  .0o70.........Gl\n00000300: 6174 762e 6223 2023 2320 606f 6469 6e67  atv.b# ## `oding\n00000310: 3a20 6c61 7469 6e33 2f30 ffff ffff ffff  : latin3/0......\n00000320: ffff 6c61 7469 6e37 ffff ff64 6361 7365  ..latin7...dcase\n00000330: 6464 6464 6464 792e 2e5f 5f72 740a 636c  ddddddy..__rt.cl\n00000340: 6173 7320 696e 3228 ba29 3a0a 2020 6464  ass in2(.):.  dd\n00000350: 6464 6464 6762 6c0a 0a20 2063 6c61 7373  ddddgbl..  class\n00000360: 2047 ed0a 306f 3730 0a0a 0a0a 0a0a 0a0a   G..0o70........\n00000370: 0a74 7661 476c 2e5f 5f72 740a 636c 6173  .tvaGl.__rt.clas\n00000380: 7320 696e 3228 cf29 3a0a 2020 6464 6464  s in2(.):.  dddd\n00000390: 6464 6762 6c0a 0a20 2043 6c61 7373 2047  ddgbl..  Class G\n000003a0: ed5b 5f70 7277 6561 6e70 6572 5d3a 6125  .[_prweanper]:a%\n000003b0: 6464 6223 2067 6237 3531 3734 3631 3034  ddb# gb751746104\n000003c0: 3530 3935 3634 3039 3431 3731 3531 2320  50956409417151# \n000003d0: 636f 6464 6464 640a 0a23 2063 6f64 696e  coddddd..# codin\n000003e0: 673d 6c61 7469 6e2d 310a 0a0a 476c 6174  g=latin-1...Glat\n000003f0: 762e 5f5f 7274 0a63 6c61 7373 2069 6e32  v.__rt.class in2\n00000400: 28ba 293a 0a20 2064 6464 6464 6467 626c  (.):.  ddddddgbl\n00000410: 0a0a 0a0a 0a0a 0a0a 0a47 6c61 7476 2e5f  .........Glatv._\n00000420: 5f72 740a 636c 6173 7320 696e 3228 cf29  _rt.class in2(.)\n00000430: 3a0a 2020 6464 6464 6464 6762 6c0a 0a20  :.  ddddddgbl.. \n00000440: 2063 6c61 7373 2047 ed5b 5f70 7277 6561   class G.[_prwea\n00000450: 6e70 6572 5d3a 6125 6464 6264 6464 6464  nper]:a%ddbddddd\n00000460: 6762 6b0a 0a20 2064 6464 6464 640a 0a0a  gbk..  dddddd...\n00000470: 476c 6174 762e 5f5f 7274 0a63 6c61 7373  Glatv.__rt.class\n00000480: 2069 6e32 28ba 293a 0a20 2064 6464 6464   in2(.):.  ddddd\n00000490: 6467 626c 0a0a 2020 636c 6173 7320 47ed  dgbl..  class G.\n000004a0: 5b5f 7072 7765 616e 7065 725d 3a61 7464  [_prweanper]:atd\n000004b0: 6464 640a 0a0a 0100 000d 0a0a 0a0a 0a30  ddd............0\n000004c0: 6f37 300a 0a0a 0a0a 0a0a 0a74 7279 3a20  o70........try: \n000004d0: 0a47 6c61 0a0a 0a0a 0a0a 0a47 6c61 7476  .Gla.......Glatv\n000004e0: 2e5f 5f72 740a 636c 6173 7320 696e 3228  .__rt.class in2(\n000004f0: cf29 3a0a 2020 6464 6464 6464 6762 6c0a  .):.  ddddddgbl.\n00000500: 0a20 2063 6cff ffff ffff ffff ffff ffff  .  cl...........\n00000510: ffff ffff ffff ffff ffff ffff ffff ffff  ................\n00000520: 6173 7320 47ed 5b5f 7072 7765 616e 7065  ass G.[_prweanpe\n00000530: 725d 3a61 2564 6462 6464 6464 6467 626b  r]:a%ddbdddddgbk\n00000540: 0a0a 2020 6464 6464 6464 0a0a 0a43 6c61  ..  dddddd...Cla\n00000550: 7476 2e5f 5f72 740a 636c 6173 7320 6965  tv.__rt.class ie\n00000560: 3228 ba29 3a0a 2020 6464 6464 6464 6762  2(.):.  ddddddgb\n00000570: 6c0a 0a20 2063 6c61 7373 2047 ed5b 5f70  l..  class G.[_p\n00000580: 7277 6561 6e70 6572 5d3a 6174 640a ee0a  rweanper]:atd...\n00000590: 0a0a 0a0a 0a30 6f37 300a 0a0a 0a0a 0a0a  .....0o70.......\n000005a0: 0a0a 2f3d 2074 762e 5f5f 7274 0a63 6c61  ../= tv.__rt.cla\n000005b0: 7373 2069 6e32 28cf 293a 0a20 2064 6464  ss in2(.):.  ddd\n000005c0: 6464 6467 626c 0a0a 5f70 7277 6561 6e70  dddgbl.._prweanp\n000005d0: 6572 5d3a 6174 6464 6464 0a0a 2320 636f  er]:atdddd..# co\n000005e0: 6469 6e67 3d74 6820 6223 2023 2320 636f  ding=th b# ## co\n000005f0: 64ff ffff 7479 7065 ff64 6464 6464 6464  d...type.ddddddd\n00000600: 792e 62                                  y.b\n~/p/cpython ❯❯❯ ./python.exe -c '\n                data = open(\"/Users/alex_gaynor/Downloads/clusterfuzz-testcase-minimized-fuzz_pycompile-5092056728403968\", \"rb\").read()\n                start = [\"eval\", \"single\", \"exec\"][data[0] % 3]\n                opt = data[1] % 4\n                compile(data[2:].split(b\"\\x00\")[0], \"\u003cfuzz\u003e\", start, optimize=opt)'\npython.exe(19196,0x1f3918240) malloc: nano zone abandoned due to inability to reserve vm space.\n\u003cstring\u003e:2: ResourceWarning: unclosed file \u003c_io.BufferedReader name='/Users/alex_gaynor/Downloads/clusterfuzz-testcase-minimized-fuzz_pycompile-5092056728403968'\u003e\n  data = open(\"/Users/alex_gaynor/Downloads/clusterfuzz-testcase-minimized-fuzz_pycompile-5092056728403968\", \"rb\").read()\nResourceWarning: Enable tracemalloc to get the object allocation traceback\nInclude/object.h:268:20: runtime error: member access within null pointer of type 'PyObject' (aka 'struct _object')\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Include/object.h:268:20 in \nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==19196==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x000104329198 bp 0x00016bddd130 sp 0x00016bddd000 T0)\n==19196==The signal is caused by a READ memory access.\n==19196==Hint: address points to the zero page.\n    #0 0x104329198 in _PyCode_ConstantKey codeobject.c:2417\n    #1 0x104329430 in _PyCode_ConstantKey codeobject.c:2479\n    #2 0x104859bec in const_cache_insert compile.c:315\n    #3 0x104859794 in _PyCompile_ConstCacheMergeOne compile.c:1233\n    #4 0x104722d20 in _PyAssemble_MakeCodeObject assemble.c:754\n    #5 0x10485ad24 in _PyCompile_OptimizeAndAssemble compile.c:1369\n    #6 0x104812d58 in codegen_visit_stmt codegen.c:2897\n    #7 0x10480ba24 in _PyCodegen_Body codegen.c:828\n    #8 0x104824604 in codegen_class_body codegen.c:1483\n    #9 0x104812740 in codegen_visit_stmt codegen.c:2897\n    #10 0x10480ba24 in _PyCodegen_Body codegen.c:828\n    #11 0x10485d27c in compiler_codegen compile.c\n    #12 0x10485b518 in _PyAST_Compile compile.c:1382\n    #13 0x1049c48f0 in Py_CompileStringObject pythonrun.c:1497\n    #14 0x10475cb34 in builtin_compile bltinmodule.c.h:363\n    #15 0x1044669fc in cfunction_vectorcall_FASTCALL_KEYWORDS methodobject.c:452\n    #16 0x104304afc in _PyObject_VectorcallTstate pycore_call.h:167\n    #17 0x1047994f8 in _PyEval_EvalFrameDefault generated_cases.c.h:2013\n    #18 0x1047698b4 in PyEval_EvalCode ceval.c:658\n    #19 0x1049c66b8 in run_eval_code_obj pythonrun.c:1338\n    #20 0x1049c6204 in run_mod pythonrun.c:1423\n    #21 0x1049c21c4 in _PyRun_StringFlagsWithName pythonrun.c:1222\n    #22 0x1049c2004 in _PyRun_SimpleStringFlagsWithName pythonrun.c:548\n    #23 0x104a57cc4 in Py_RunMain main.c:776\n    #24 0x104a591b8 in pymain_main main.c:806\n    #25 0x104a59554 in Py_BytesMain main.c:830\n    #26 0x189cb8270  (\u003cunknown module\u003e)\n\n==19196==Register values:\n x[0] = 0x000000016bddcf18   x[1] = 0x0000000000000000   x[2] = 0x0000000000000000   x[3] = 0x00000001084007a0  \n x[4] = 0x0000000063000000   x[5] = 0x0000000000000000   x[6] = 0x0000000000000000   x[7] = 0x0000000000000000  \n x[8] = 0x0000000000000000   x[9] = 0x00000001064be5e8  x[10] = 0x0000000000000000  x[11] = 0x0000000000000084  \nx[12] = 0x0000000105c50000  x[13] = 0x00000001064c06e8  x[14] = 0x0000000000000000  x[15] = 0x0000000000000000  \nx[16] = 0x000000030a47dd90  x[17] = 0x00000001064180a0  x[18] = 0x0000000000000000  x[19] = 0x000000016bddd080  \nx[20] = 0x000000016bddd000  x[21] = 0x0000000000000000  x[22] = 0x0000000000000008  x[23] = 0x000000702d7dba00  \nx[24] = 0x0000000000000000  x[25] = 0x0000007000020000  x[26] = 0x0000000000000000  x[27] = 0x0000000000000000  \nx[28] = 0x0000000000000001     fp = 0x000000016bddd130     lr = 0x0000000104329834     sp = 0x000000016bddd000  \nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV codeobject.c:2417 in _PyCode_ConstantKey\n==19196==ABORTING\nfish: Job 1, './python.exe -c '' terminated by signal data = open(\"/Users/alex_gaynor… (start = [\"eval\", \"single\", \"exe…)\nfish: Job opt = data[1] % 4, 'compile(data[2:].split(b\"\\x00\")…' terminated by signal SIGABRT (Abort)\n```\n\nFound by OSS-Fuzz.\n\n### CPython versions tested on:\n\nCPython main branch\n\n### Operating systems tested on:\n\n_No response_\n\n### Output from running 'python -VV' on the command line:\n\n_No response_\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-128744\n* gh-132085\n* gh-132090\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/alex","@type":"Person","name":"alex"},"datePublished":"2025-01-08T12:42:40.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":15},"url":"https://github.com/128632/cpython/issues/128632"}