René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Segfault: Py_DECREF(NULL) in PyContextVar_Set (context.c:367)","articleBody":"# Crash report\n\n### What happened?\n\n# Segfault: `Py_DECREF(NULL)` in `PyContextVar_Set` (`context.c:367`)\n\n*`PyContextVar_Set` doesn't NULL-check `token_new()`; under OOM the `contextvar_set()` error path then `Py_DECREF`s the NULL token.*\n\n_AI Disclaimer: this gist was drafted by Claude Code, which also generated the reduced reproducer._\n\n## Crash report\n\n`PyContextVar_Set` does not NULL-check the result of `token_new()`. Under memory pressure `token_new()` returns NULL; if the following `contextvar_set()` also fails, the error path runs `Py_DECREF(tok)` on the NULL token and segfaults.\n\n## Reproducer\n\n```python\nimport contextvars\nfrom _testcapi import set_nomemory, remove_mem_hooks\ncv = contextvars.ContextVar(\"x\")\nfor start in range(16):            # crashes at start=2\n    set_nomemory(start, 0)\n    try:\n        try:\n            cv.set(object())\n        finally:\n            remove_mem_hooks()\n    except MemoryError:\n        pass\n```\n\nA single `set_nomemory(0, 0); cv.set(object())` does *not* crash — `PyContextVar_Set`'s own early `context_get()` fails first and returns cleanly. The crash needs a budget where the early allocations succeed but `token_new()` and `contextvar_set()` then fail, hence the short sweep.\n\n## Backtrace\n\n```\n#0 _Py_atomic_load_uint32_relaxed\n#1 Py_DECREF              Include/refcount.h:345    (op == 0x0)\n#2 PyContextVar_Set       Python/context.c:367      (Py_DECREF(tok), tok == NULL)\n```\n\n## Root cause\n\n`Python/context.c`, `PyContextVar_Set` (L346):\n\n```c\n    PyContextToken *tok = token_new(ctx, var, old_val);  /* L363: may return NULL, UNCHECKED */\n    Py_XDECREF(old_val);\n    if (contextvar_set(var, val)) {                      /* L366: fails under OOM (_PyHamt_Assoc -\u003e NULL) */\n        Py_DECREF(tok);                                  /* L367: tok == NULL -\u003e SIGSEGV */\n        return NULL;\n    }\n    return (PyObject *)tok;\n```\n\n`token_new()` allocates (`PyObject_GC_New`) and can return NULL on failure, but `tok` is not checked before the `Py_DECREF(tok)` on the `contextvar_set()` failure path. (On the success path the function also returns `tok` unchecked — harmless NULL-with-exception, but the modification still happened.)\n\n## Suggested fix\n\n```c\n    PyContextToken *tok = token_new(ctx, var, old_val);\n    Py_XDECREF(old_val);\n    if (tok == NULL) {\n        return NULL;\n    }\n```\n\n(or `Py_XDECREF(tok)` on the error path).\n\n## Notes\n\nFound by OOM-injection fuzzing (`set_nomemory`). Same pattern as gh-146080 (`Py_DECREF(NULL)` in an `_ssl.c` error label). **Not** free-threading-specific: reproduces on free-threaded and default (GIL) builds, debug and release. (A `_py_warnings`/`ContextVar` vehicle reaches this only when `context_aware_warnings` is enabled — the default on free-threaded builds — but the C bug is build-agnostic.)\n\n## Versions\n\n- main (3.16.0a0); reproduced on free-threaded debug+ASan, free-threaded release, and GIL release builds.\n\n---\n\n*Part of [python/cpython#151763](https://github.com/python/cpython/issues/151763) — an umbrella tracking 35 OOM-related crash findings.*\n\n### CPython versions tested on:\n\n3.16, CPython main branch\n\n### Operating systems tested on:\n\nWindows\n\n### Output from running 'python -VV' on the command line:\n\nPython 3.9.23 (main, Jun  4 2025, 08:55:39) [GCC 13.3.0]\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-151836\n* gh-152009\n* gh-152010\n* gh-152011\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/prakashsellathurai","@type":"Person","name":"prakashsellathurai"},"datePublished":"2026-06-20T08:00:25.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":3},"url":"https://github.com/151773/cpython/issues/151773"}