Crash report

What happened?

It's possible to raiseSystemError fromtermios.tcsetwinsize by passing a sequence that raises on__getitem__ to it.

Automated diagnosis:

Bug:termios.tcsetwinsize passesNULL toPyLong_AsLong.PySequence_GetItem(winsz, 0) can returnNULL (e.g.,__getitem__ raises). The result is passed directly toPyLong_AsLong(NULL) which callsPyErr_BadInternalCall(), masking the real error withSystemError.

File:Modules/termios.c, lines 502-510

MRE:

importtermiosimportosfd=os.open("/dev/tty",os.O_RDWR|os.O_NOCTTY)classBadSequence:def__len__(self):return2def__getitem__(self,idx):raiseTypeErrortermios.tcsetwinsize(fd,BadSequence())

Backtrace:

Traceback (mostrecentcalllast):File"/home/danzin/crashers/trigger_termios_null_pylong.py",line23,in<module>termios.tcsetwinsize(fd,BadSequence())~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^SystemError:Objects/longobject.c:598:badargumenttointernalfunction

Found usingcpython-review-toolkit with Claude Opus 4.6, using the/cpython-review-toolkit:explore Modules/termios.c all deep command.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.15.0a7+ (heads/main:e0f7c1097e1, Mar 17 2026, 18:10:52) [Clang 21.1.2 (2ubuntu6)]

Linked PRs

• gh-146091: Fix NULL check in termios.tcsetwinsize #146147