René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"symtable: NULL dereference after OOM in PyUnicode_FromFormat (symtable_visit_type_param_bound_or_default)","articleBody":"`symtable_visit_type_param_bound_or_default` in `Python/symtable.c` calls `PyUnicode_FromFormat()` to build a `SyntaxError` message when a type parameter is named `__classdict__`. The return value is not checked for NULL before being passed to `PyErr_SetObject()` and `Py_DECREF()`.\n\nIf `PyUnicode_FromFormat()` fails due to memory exhaustion, `error_msg` is NULL. The subsequent `Py_DECREF(NULL)` is undefined behavior and crashes the interpreter in a release build (NDEBUG).\n\nAffected code (introduced by commit `891c61c`, `gh-128632`):\n```\n// Python/symtable.c\nPyObject *error_msg = PyUnicode_FromFormat(\"reserved name '%U' cannot be \"\n                                           \"used for type parameter\", name);\nPyErr_SetObject(PyExc_SyntaxError, error_msg);   // UB if error_msg is NULL\nPy_DECREF(error_msg);                            // crash if error_msg is NULL\n```\n\n**Trigger condition:** `PyUnicode_FromFormat()` returns NULL while compiling Python source that contains a type parameter named `__classdict__` (e.g. type `T[__classdict__: int] = None`). In normal conditions this requires an OOM event at exactly that point; in constrained environments this is reproducible with ulimit or fault injection.\n\n**Expected behavior:** `MemoryError` is propagated cleanly.\n\n**Actual behavior:** `Py_DECREF(NULL)` --\u003e `SIGSEGV` in release builds; assertion failure in debug builds.\n\nCPython versions tested on: 3.13 (main, 3.13 branch)\n\nOperating systems tested on: Linux Fedora 43\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-152684\n* gh-152695\n* gh-152696\n* gh-152697\n* gh-152770\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/petrvaganoff","@type":"Person","name":"petrvaganoff"},"datePublished":"2026-06-30T13:33:48.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/152682/cpython/issues/152682"}