René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Segfault from `NULL` dereference in `_zoneinfo.get_weak_cache`","articleBody":"# Crash report\n\n### What happened?\n\nIt's possible to cause a segfault by deleting the `_weak_cache` of a `ZoneInfo` subclass, then trying to access the removed cache.\n\n### Automated diagnosis:\n\nBug: `NULL` dereference via unchecked `get_weak_cache` return. `get_weak_cache()` can return `NULL` for `ZoneInfo` subclasses that lack a `_weak_cache` attribute. The return value is used at lines 323 and 498 without `NULL` checks, passing `NULL` to `PyObject_CallMethod` -\u003e segfault.\n\nFile: `Modules/_zoneinfo.c`, lines 323 and 498\n\nMRE:\n\n```python\nfrom zoneinfo import ZoneInfo\n\nclass BadZoneInfo(ZoneInfo):\n    pass\n\ndelattr(BadZoneInfo, '_weak_cache')\nBadZoneInfo(\"UTC\")\nBadZoneInfo.clear_cache()\n```\n\nBacktrace:\n```\nProgram received signal SIGSEGV, Segmentation fault.\n0x00007bfff598d1ec in Py_DECREF (lineno=326, op=0x0, filename=\u003coptimized out\u003e) at ./Include/refcount.h:390\n390         if (op-\u003eob_refcnt_full \u003c= 0 || op-\u003eob_refcnt \u003e (((PY_UINT32_T)-1) - (1\u003c\u003c20))) {\n\n#0  0x00007bfff598d1ec in Py_DECREF (lineno=326, op=0x0, filename=\u003coptimized out\u003e) at ./Include/refcount.h:390\n#1  zoneinfo_ZoneInfo_impl (type=type@entry=0x7d8ff702dda0, key=key@entry=0x7c6ff70e7a20) at ./Modules/_zoneinfo.c:326\n#2  0x00007bfff5982b63 in zoneinfo_ZoneInfo (type=\u003coptimized out\u003e, args=0x7c6ff70409f0, kwargs=\u003coptimized out\u003e) at ./Modules/clinic/_zoneinfo.c.h:64\n#3  0x0000555555c7beb3 in type_call (self=\u003coptimized out\u003e, args=\u003coptimized out\u003e, kwds=\u003coptimized out\u003e) at Objects/typeobject.c:2441\n#4  0x0000555555aba90b in _PyObject_MakeTpCall (tstate=0x5555568f7b18 \u003c_PyRuntime+360664\u003e, callable=0x7d8ff702dda0, args=0x7bfff5d1af28, nargs=1, keywords=0x0) at Objects/call.c:242\n#5  0x0000555555e588dd in _Py_VectorCallInstrumentation_StackRefSteal (callable=..., arguments=\u003coptimized out\u003e, total_args=1, kwnames=..., call_instrumentation=\u003coptimized out\u003e,\n    frame=\u003coptimized out\u003e, this_instr=\u003coptimized out\u003e, tstate=\u003coptimized out\u003e) at Python/ceval.c:770\n#6  0x0000555555e94263 in _PyEval_EvalFrameDefault (tstate=\u003coptimized out\u003e, frame=\u003coptimized out\u003e, throwflag=\u003coptimized out\u003e) at Python/generated_cases.c.h:1838\n#7  0x0000555555e57778 in _PyEval_EvalFrame (tstate=0x5555568f7b18 \u003c_PyRuntime+360664\u003e, frame=0x7e8ff6fe5220, throwflag=0) at ./Include/internal/pycore_ceval.h:118\n#8  _PyEval_Vector (tstate=\u003coptimized out\u003e, func=\u003coptimized out\u003e, locals=\u003coptimized out\u003e, args=\u003coptimized out\u003e, argcount=\u003coptimized out\u003e, kwnames=0x0) at Python/ceval.c:2134\n#9  0x0000555555e57195 in PyEval_EvalCode (co=\u003coptimized out\u003e, globals=\u003coptimized out\u003e, locals=0x7c7ff70884c0) at Python/ceval.c:681\n#10 0x0000555556061fb0 in run_eval_code_obj (tstate=tstate@entry=0x5555568f7b18 \u003c_PyRuntime+360664\u003e, co=co@entry=0x7d2ff6ffde10, globals=globals@entry=0x7c7ff70884c0,\n    locals=locals@entry=0x7c7ff70884c0) at Python/pythonrun.c:1368\n#11 0x000055555606117c in run_mod (mod=\u003coptimized out\u003e, filename=\u003coptimized out\u003e, globals=\u003coptimized out\u003e, locals=\u003coptimized out\u003e, flags=\u003coptimized out\u003e, arena=\u003coptimized out\u003e,\n    interactive_src=\u003coptimized out\u003e, generate_new_source=\u003coptimized out\u003e) at Python/pythonrun.c:1471\n#12 0x000055555605b69d in pyrun_file (fp=fp@entry=0x7d4ff6fefd00, filename=filename@entry=0x7cbff6ffc490, start=start@entry=257, globals=globals@entry=0x7c7ff70884c0,\n    locals=locals@entry=0x7c7ff70884c0, closeit=closeit@entry=1, flags=0x7bfff5e1ef10) at Python/pythonrun.c:1295\n#13 0x00005555560591fd in _PyRun_SimpleFileObject (fp=\u003coptimized out\u003e, filename=\u003coptimized out\u003e, closeit=\u003coptimized out\u003e, flags=\u003coptimized out\u003e) at Python/pythonrun.c:518\n#14 0x000055555605856e in _PyRun_AnyFileObject (fp=fp@entry=0x7d4ff6fefd00, filename=filename@entry=0x7cbff6ffc490, closeit=closeit@entry=1, flags=flags@entry=0x7bfff5e1ef10)\n    at Python/pythonrun.c:81\n#15 0x00005555560d721b in pymain_run_file_obj (program_name=0x7caff7024fc0, filename=0x7cbff6ffc490, skip_source_first_line=0) at Modules/main.c:410\n#16 pymain_run_file (config=0x5555568c2b50 \u003c_PyRuntime+143632\u003e) at Modules/main.c:429\n#17 0x00005555560d54b2 in pymain_run_python (exitcode=0x7bfff5e1eb00) at Modules/main.c:714\n#18 Py_RunMain () at Modules/main.c:795\n```\n\nFound using [cpython-review-toolkit](https://github.com/devdanzin/cpython-review-toolkit) with Claude Opus 4.6, using the `/cpython-review-toolkit:explore Modules/_zoneinfo.c all deep` command.\n\n\n\n### CPython versions tested on:\n\nCPython main branch\n\n### Operating systems tested on:\n\nLinux\n\n### Output from running 'python -VV' on the command line:\n\nPython 3.15.0a7+ (heads/main:99e2c5eccd2, Mar 17 2026, 08:26:50) [Clang 21.1.2 (2ubuntu6)]\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-146082\n* gh-146115\n* gh-146116\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/devdanzin","@type":"Person","name":"devdanzin"},"datePublished":"2026-03-17T18:52:15.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/146076/cpython/issues/146076"}