René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Segfault: NULL info deref in _excinfo_clear_type via _PyXI_FreeExcInfo(NULL) (Python/crossinterp.c:1319)","articleBody":"# Crash report\n\n## Segfault: NULL `info` deref in `_excinfo_clear_type` via `_PyXI_FreeExcInfo(NULL)`\n\n`_interpreters.capture_exception()` builds a `_PyXI_excinfo` via `_PyXI_NewExcInfo()`. Under memory pressure that allocation can fail and return `NULL`. The cleanup path in `_interpreters_capture_exception_impl` then unconditionally calls `_PyXI_FreeExcInfo(info)` with `info == NULL`. `_PyXI_FreeExcInfo` has no NULL guard, so `_PyXI_excinfo_clear` → `_excinfo_clear_type` dereferences `\u0026NULL-\u003etype` (offset 0) at `Python/crossinterp.c:1319` → SIGSEGV.\n\nThis reproduces on all build configurations (a NULL dereference, not a debug-only assert).\n\n### Reproducer\n\n```python\nimport faulthandler, _interpreters\nfaulthandler.enable()\nfrom _testcapi import set_nomemory, remove_mem_hooks\nfor start in range(0, 40):\n    try:\n        set_nomemory(start, 0)\n        try:\n            _interpreters.capture_exception(Exception())\n        finally:\n            remove_mem_hooks()\n    except BaseException:\n        pass\n    finally:\n        try: remove_mem_hooks()\n        except Exception: pass\n```\n\n### Backtrace\n\n```\n#0  _excinfo_clear_type                  Python/crossinterp.c:1319   # info == 0x0 -\u003e offset-0 deref\n#1  _PyXI_excinfo_clear                  Python/crossinterp.c:1374\n#2  _PyXI_FreeExcInfo                    Python/crossinterp.c:1712   # called with info == NULL, no guard\n#3  _interpreters_capture_exception_impl Modules/_interpretersmodule.c:1544\n#4  cfunction_vectorcall_FASTCALL_KEYWORDS Objects/methodobject.c:465\n```\n\n### Root cause\n\n`Modules/_interpretersmodule.c`, `_interpreters_capture_exception_impl` (≈L1522-1544):\n\n```c\n_PyXI_excinfo *info = _PyXI_NewExcInfo(exc);   /* returns NULL under OOM */\nif (info == NULL) {\n    goto finally;\n}\n/* ... */\nfinally:\n    _PyXI_FreeExcInfo(info);                   /* L1544: runs even when info == NULL */\n```\n\n`_PyXI_NewExcInfo` (`crossinterp.c:1683`) does `PyMem_RawCalloc` for its struct and, on any failure, `PyMem_RawFree`s it and returns `NULL` — so `info` here is a clean `NULL`, not a dangling half-built struct.\n\n`_PyXI_FreeExcInfo` (`crossinterp.c:1710`) has no NULL guard:\n\n```c\nvoid\n_PyXI_FreeExcInfo(_PyXI_excinfo *info)\n{\n    _PyXI_excinfo_clear(info);   /* dereferences info */\n    PyMem_RawFree(info);\n}\n```\n\n### Suggested fix\n\nMake `_PyXI_FreeExcInfo` NULL-safe, matching the surrounding `PyMem_RawFree(NULL)` idiom (and `Py_XDECREF`, `free()`, etc.):\n\n```c\nvoid\n_PyXI_FreeExcInfo(_PyXI_excinfo *info)\n{\n    if (info == NULL) {\n        return;\n    }\n    _PyXI_excinfo_clear(info);\n    PyMem_RawFree(info);\n}\n```\n\nThis is more defensive than guarding only the one call site, since the function is part of the cross-interpreter exception ABI and any future caller would otherwise have the same hazard.\n\n### Notes\n\nPart of #151763 (umbrella tracking 35 OOM-related crash findings); OOM-0031 in that table.\n\n### CPython versions tested on:\n\nCPython main branch (3.16.0a0)\n\n### Operating systems tested on:\n\nLinux, Windows\n\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-151843\n* gh-152031\n* gh-152032\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/amruthamodela06","@type":"Person","name":"amruthamodela06"},"datePublished":"2026-06-21T12:44:00.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/151842/cpython/issues/151842"}