René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Segfault: dealloc of uninitialized iterator in template_iter (Objects/templateobject.c:232)","articleBody":"# Crash report\n\n## Segfault: dealloc of uninitialized iterator in `template_iter` (`Objects/templateobject.c:232`)\n\n`template_iter()` allocates the t-string iterator with `PyObject_GC_New` (which does **not** zero the new object) and only assigns `iter-\u003estringsiter` and `iter-\u003einterpolationsiter` *after* both `PyObject_GetIter` calls succeed. If either `PyObject_GetIter` fails under memory pressure, the error-path `Py_DECREF(iter)` runs `templateiter_dealloc` → `templateiter_clear`, which `Py_CLEAR`s the still-uninitialized (garbage / ASan-poisoned) pointers, causing a segfault.\n\n### Reproducer\n\n(needs CPython 3.14+ for t-string / PEP 750 syntax)\n\n```python\nfrom _testcapi import set_nomemory, remove_mem_hooks\n\nt = t\"x{1}y{2}z\"\n\nfor start in range(1, 1000):\n    set_nomemory(start, 0)\n    try:\n        try:\n            iter(t)\n        finally:\n            remove_mem_hooks()\n    except MemoryError:\n        pass\n```\n\n### Backtrace\n\n```\n#0  _Py_atomic_load_uint32_relaxed\n#1  Py_DECREF\n#2  templateiter_clear           Objects/templateobject.c:53   # Py_CLEAR(self-\u003estringsiter), uninitialized\n#3  templateiter_dealloc         Objects/templateobject.c:45\n#4  _Py_Dealloc\n#5  Py_DECREF\n#6  template_iter                Objects/templateobject.c:232  # Py_DECREF(iter) on the error path\n#7  PyObject_GetIter\n```\n\nCrashes deterministically on debug+ASan and JIT debug+ASan builds. On non-ASan release builds it usually exits cleanly within the swept budget (the uninitialized memory often happens to be zero), but the underlying access of uninitialized fields is still incorrect.\n\n### Root cause\n\n[Objects/templateobject.c](https://github.com/python/cpython/blob/main/Objects/templateobject.c), `template_iter`:\n\n```c\ntemplateiterobject *iter = PyObject_GC_New(templateiterobject, \u0026_PyTemplateIter_Type);  /* no zeroing */\nif (iter == NULL) {\n    return NULL;\n}\n\nPyObject *stringsiter = PyObject_GetIter(self-\u003estrings);\nif (stringsiter == NULL) {\n    Py_DECREF(iter);   /* iter-\u003estringsiter / -\u003einterpolationsiter are uninitialized */\n    return NULL;\n}\n\nPyObject *interpolationsiter = PyObject_GetIter(self-\u003einterpolations);\nif (interpolationsiter == NULL) {\n    Py_DECREF(iter);   /* same: iter-\u003einterpolationsiter is uninitialized */\n    Py_DECREF(stringsiter);\n    return NULL;\n}\n```\n\n### Suggested fix\n\nInitialize `iter-\u003estringsiter` and `iter-\u003einterpolationsiter` to `NULL` immediately after `PyObject_GC_New`, so the partial-construction error paths can safely run `templateiter_clear` (which uses `Py_CLEAR`, NULL-safe):\n\n```c\ntemplateiterobject *iter = PyObject_GC_New(templateiterobject, \u0026_PyTemplateIter_Type);\nif (iter == NULL) {\n    return NULL;\n}\niter-\u003estringsiter = NULL;\niter-\u003einterpolationsiter = NULL;\n```\n\n### Notes\n\nPart of #151763 (umbrella tracking 35 OOM-related crash findings); OOM-0024 in that table.\n\n### CPython versions tested on:\n\nCPython main branch (3.16.0a0)\n\n### Operating systems tested on:\n\nLinux, Windows\n\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-151821\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/amruthamodela06","@type":"Person","name":"amruthamodela06"},"datePublished":"2026-06-20T18:41:56.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/151815/cpython/issues/151815"}