René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"`_csv.reader`: NULL deref via re-entrant iterator","articleBody":"# Bug report\n\n### Bug description:\n\nA NULL pointer dereference in `Modules/_csv.c` causes a segfault when a\ncustom iterator re-enters the same `csv.reader` from within its `__next__`\nmethod. The inner iteration sets `self-\u003efields` to `NULL`, the outer\niteration then passes that `NULL` to `PyList_Append`, crashing the\ninterpreter.\n\n```python\nimport _csv\n\n\nclass BadIterator:\n    def __init__(self):\n        self.reader = None\n        self.n = 0\n\n    def __iter__(self):\n        return self\n\n    def __next__(self):\n        self.n += 1\n        if self.n == 1:\n            try:\n                next(self.reader)\n            except StopIteration:\n                pass\n            return \"a,b\"\n        if self.n == 2:\n            return \"x\"\n        raise StopIteration\n\n\nit = BadIterator()\nr = _csv.reader(it)\nit.reader = r\nnext(r)\n```\n\n```C\n\n❯ ./build-asan/python csv_null_deref.py\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==293160==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x5dc88a0b1c52 bp 0x7ffdd3075180 sp 0x7ffdd3075170 T0)\n==293160==The signal is caused by a READ memory access.\n==293160==Hint: address points to the zero page.\n    #0 0x5dc88a0b1c52 in _Py_TYPE_impl ../Include/object.h:313\n    #1 0x5dc88a0b1c52 in PyList_Append ../Objects/listobject.c:541\n    #2 0x7ea5a8430ad5 in parse_save_field ../Modules/_csv.c:684\n    #3 0x7ea5a843129b in parse_process_char ../Modules/_csv.c:811\n    #4 0x7ea5a8431967 in Reader_iternext_lock_held ../Modules/_csv.c:971\n    #5 0x7ea5a8431bdf in Reader_iternext ../Modules/_csv.c:993\n    #6 0x5dc88a2b0820 in builtin_next ../Python/bltinmodule.c:1756\n    #7 0x5dc88a0fb36f in cfunction_vectorcall_FASTCALL ../Objects/methodobject.c:449\n    #8 0x5dc88a043ccc in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:136\n    #9 0x5dc88a043dbf in PyObject_Vectorcall ../Objects/call.c:327\n    #10 0x5dc88a2c28b7 in _Py_VectorCallInstrumentation_StackRefSteal ../Python/ceval.c:769\n    #11 0x5dc88a2d287b in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1817\n    #12 0x5dc88a309ab0 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:118\n    #13 0x5dc88a309e16 in _PyEval_Vector ../Python/ceval.c:2132\n    #14 0x5dc88a30a0cc in PyEval_EvalCode ../Python/ceval.c:680\n    #15 0x5dc88a40d771 in run_eval_code_obj ../Python/pythonrun.c:1366\n    #16 0x5dc88a40dab7 in run_mod ../Python/pythonrun.c:1469\n    #17 0x5dc88a40e9ec in pyrun_file ../Python/pythonrun.c:1294\n    #18 0x5dc88a411822 in _PyRun_SimpleFileObject ../Python/pythonrun.c:518\n    #19 0x5dc88a411ace in _PyRun_AnyFileObject ../Python/pythonrun.c:81\n    #20 0x5dc88a466df6 in pymain_run_file_obj ../Modules/main.c:410\n    #21 0x5dc88a467063 in pymain_run_file ../Modules/main.c:429\n    #22 0x5dc88a468861 in pymain_run_python ../Modules/main.c:691\n    #23 0x5dc88a468ef7 in Py_RunMain ../Modules/main.c:772\n    #24 0x5dc88a4690e3 in pymain_main ../Modules/main.c:802\n    #25 0x5dc88a469468 in Py_BytesMain ../Modules/main.c:826\n    #26 0x5dc889ece675 in main ../Programs/python.c:15\n    #27 0x7ea5a822a3b7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n    #28 0x7ea5a822a47a in __libc_start_main_impl ../csu/libc-start.c:360\n    #29 0x5dc889ece5a4 in _start (/home/raminfp/Projects/cpython/build-asan/python+0x2ee5a4) (BuildId: 84c80339980a79597ee91e337ac316189316df7c)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV ../Include/object.h:313 in _Py_TYPE_impl\n==293160==ABORTING\n```\n\n### GDB\n\n```bash\ngdb -batch \\\n  -ex \"run csv_null_deref.py\" \\\n  -ex \"frame 2\" -ex \"print self-\u003efields\" -ex \"print self-\u003estate\" \\\n  -ex \"frame 3\" -ex \"print c\" \\\n  -ex \"frame 1\" -ex \"print op\" \\\n  ./build-asan/python\n```\n\n```bash\nProgram received signal SIGSEGV, Segmentation fault.\n0x0000555555a25c52 in _Py_TYPE_impl (ob=0x0) at ../Include/object.h:313\n313\t    return ob-\u003eob_type;\n#2  0x00007ffff762dad6 in parse_save_field (self=self@entry=0x50c00000c8a0) at ../Modules/_csv.c:684\n684\t    if (PyList_Append(self-\u003efields, field) \u003c 0) {\n$1 = (PyObject *) 0x0\n$2 = IN_FIELD\n#3  0x00007ffff762e29c in parse_process_char (self=self@entry=0x50c00000c8a0, module_state=module_state@entry=0x507000112680, c=44) at ../Modules/_csv.c:811\n811\t            if (parse_save_field(self) \u003c 0)\n$3 = 44\n#1  PyList_Append (op=0x0, newitem=newitem@entry=0x555556527048 \u003c_PyRuntime+125736\u003e) at ../Objects/listobject.c:541\n541\t    if (PyList_Check(op) \u0026\u0026 (newitem != NULL)) {\n$4 = (PyObject *) 0x0\n\n````\n\n### CPython versions tested on:\n\nCPython main branch\n\n### Operating systems tested on:\n\nLinux\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-145106\n* gh-148404\n* gh-148405\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/raminfp","@type":"Person","name":"raminfp"},"datePublished":"2026-02-22T11:12:24.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/145105/cpython/issues/145105"}