Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Flawed assumptions abouttp_dictoffset in inheritance. #95589

Closed
Labels
3.10only security fixes3.11only security fixes3.12only security fixes3.9 (EOL)end of lifetype-bugAn unexpected behavior, bug, or errortype-crashA hard crash of the interpreter, possibly with a core dump
@markshannon

Description

@markshannon

In Python, the__dict__ and__weakref__ slots are treated specially (slots meaning__slots__, nottp_slots)
They are automatically insert by the VM when creating a class.

classC(list):pass>>>C().__dict__{}

In order to support inheritance, specifically multiple inheritance, the VM can lay out subclasses in ways that differ from the superclass.
This is OK, provided__dict__ and__weakref__ are only accessed though thetp_dictoffset andtp_weaklistoffset offsets.
But, if either field is accessed directly, then we access invalid memory and 💥

test.py:

from_testcapiimportHeapCTypeWithDictclassI3(HeapCTypeWithDict,list):passi=I3()i.append(0)print(i.dictobj)
$ python3.10~/test/test.py Segmentation fault (core dumped)

We have (accidentally) fixed this for__dict__ in 3.11, although at the expense breaking backwards compatibility for some C extensions. However, the problem still remains for__weakref__.

Backwards incompatibility

from_testcapiimportHeapCTypeWithDictclassI3(HeapCTypeWithDict,list):passprint("OK")
$ python3.10 test.py OK$ python3.12 test.py Traceback (most recent call last):  File"test.py", line 3,in<module>    class I3(HeapCTypeWithDict, list): passTypeError: multiple bases have instance lay-out conflict

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.10only security fixes3.11only security fixes3.12only security fixes3.9 (EOL)end of lifetype-bugAn unexpected behavior, bug, or errortype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions


      [8]ページ先頭

      ©2009-2025 Movatter.jp