René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Detect usage of uninitialized digits in `Objects/longobject.c` (`_PyLong_New()`)","articleBody":"The `_PyLong_New()` API does not initialize the digits array. Catching usage of uninitialized digits requires building Python with MSAN (`-fsanitize=memory`) which is not easy to use in practice.\n\n---\n\nExample to reproduce the old issue gh-102509.\n\n(1) Apply the patch:\n\n```diff\ndiff --git a/Objects/longobject.c b/Objects/longobject.c\nindex d416fc1747e..343c03f61ed 100644\n--- a/Objects/longobject.c\n+++ b/Objects/longobject.c\n@@ -170,7 +170,7 @@ long_alloc(Py_ssize_t size)\n     Py_ssize_t ndigits = size ? size : 1;\n \n     if (ndigits == 1) {\n-        result = (PyLongObject *)_Py_FREELIST_POP(PyLongObject, ints);\n+        //result = (PyLongObject *)_Py_FREELIST_POP(PyLongObject, ints);\n     }\n     if (result == NULL) {\n         /* Number of bytes needed is: offsetof(PyLongObject, ob_digit) +\n@@ -189,7 +189,7 @@ long_alloc(Py_ssize_t size)\n     _PyLong_SetSignAndDigitCount(result, size != 0, size);\n     /* The digit has to be initialized explicitly to avoid\n      * use-of-uninitialized-value. */\n-    result-\u003elong_value.ob_digit[0] = 0;\n+    //result-\u003elong_value.ob_digit[0] = 0;\n     return result;\n }\n\n```\n\n(2) Build Python with MSAN (`--with-memory-sanitizer`):\n\n```\n./configure --with-memory-sanitizer --without-pymalloc CC=clang LD=clang CFLAGS=\"-O0\"\nmake clean\nmake\n```\n\n(3) `make` fails with an error like:\n\n```\n==1336053==WARNING: MemorySanitizer: use-of-uninitialized-value\n    #0 0x000000f12cf9 in _PyLong_CompactValue /home/vstinner/python/main/./Include/cpython/longintrepr.h:136:5\n    #1 0x000000f23f7f in maybe_small_long /home/vstinner/python/main/Objects/longobject.c:71:27\n    #2 0x000000fcdc76 in long_bitwise /home/vstinner/python/main/Objects/longobject.c:5680:24\n    #3 0x000000faacbc in long_and /home/vstinner/python/main/Objects/longobject.c:5692:12\n    (...)\n\n  Uninitialized value was created by a heap allocation\n    #0 0x000000440506 in malloc (/home/vstinner/python/main/_bootstrap_python+0x440506) (BuildId: 9ec2535b6793427eb2f3574683be353b2e36dfef)\n    #1 0x00000129301b in _PyMem_RawMalloc /home/vstinner/python/main/Objects/obmalloc.c:65:12\n    #2 0x00000129ff39 in PyObject_Malloc /home/vstinner/python/main/Objects/obmalloc.c:1649:12\n    #3 0x000000f11278 in long_alloc /home/vstinner/python/main/Objects/longobject.c:181:18\n    #4 0x000000fcc37b in long_bitwise /home/vstinner/python/main/Objects/longobject.c:5638:9\n    #5 0x000000faacbc in long_and /home/vstinner/python/main/Objects/longobject.c:5692:12\n    (...)\n```\n\nYou can see that `long_bitwise()` doesn't initialize `ob_digit[0]` anymore (because of the patch), and so `maybe_small_long()` fails on calling `_PyLong_CompactValue()` which uses `ob_digit[0]`.\n\n---\n\nI propose changing `long_alloc()` to initialize digits to a pattern to detect the usage of uninitialized digits when Python is built in debug mode. It should catch bugs like the old issue gh-102509 without having to use the heavy MSAN.\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-147989\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/vstinner","@type":"Person","name":"vstinner"},"datePublished":"2026-04-01T20:12:36.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":2},"url":"https://github.com/147988/cpython/issues/147988"}