Crash report

What happened?

It's possible to abort the interpreter by callingStringIO.__setstate__ with a non-stringinitial_value:

python-c"from io import StringIO; StringIO().__setstate__((None, '', 0, {}))"python:Objects/unicodeobject.c:2542:as_ucs4:Assertion `PyUnicode_Check(string)'failed.Aborted (coredumped)

Interestingly, on a non-debug build passing an int asinitial_value gives an error message saying thatNone should be a valid value:

python-c"from io import StringIO; StringIO().__setstate__((1, '', 0, {}))"Traceback (mostrecentcalllast):File"<string>",line1,in<module>fromioimportStringIO;StringIO().__setstate__((1,'',0, {}))~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^TypeError:initial_valuemustbestrorNone,notint

Found usingfusil by@vstinner.

CPython versions tested on:

3.13, 3.14, CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.14.0a2+ (heads/main:0af4ec3, Nov 20 2024, 21:45:19) [GCC 13.2.0]

Linked PRs

• gh-127182: Fixio.StringIO.__setstate__ crash whenNone is the first value #127219
• [3.13] gh-127182: Fixio.StringIO.__setstate__ crash whenNone is the first value (GH-127219) #127262
• [3.12] gh-127182: Fixio.StringIO.__setstate__ crash whenNone is the first value (GH-127219) #127263