GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — `Unpacker.unpack()` segfaults after an incomplete `skip()` · Issue #734 · msgpack/msgpack-python

Unpacker.unpack() segfaults after an incomplete skip() #734

New issue
Copy link
New issue
Copy link
Closed
Closed
Unpacker.unpack() segfaults after an incomplete skip()#734
Copy link

Description

@marinelay
marinelay
opened on Aug 28, 2026
Issue body actions

Summary

When Unpacker.skip() raises OutOfData for incomplete input, the remaining data can be supplied using feed().
Calling unpack() afterward causes a segmentation fault instead of returning the completed value or raising an exception.

Versions

msgpack 1.2.2, CPython 3.12.3, Ubuntu 24.04 x86_64, glibc 2.39.

Reproducer

import msgpack

unpacker = msgpack.Unpacker()
unpacker.feed(b"\x91")

try:
    unpacker.skip()
except msgpack.OutOfData:
    pass

unpacker.feed(b"\x00")
unpacker.unpack()

Running it produces:

$ python reproducer.py
Segmentation fault (core dumped)

For comparison, calling skip() again after an incomplete skip(), or calling unpack() again after an incomplete unpack(), completes normally:

import msgpack

# Incomplete skip() followed by skip()
skip_again = msgpack.Unpacker()
skip_again.feed(b"\x91")

try:
    skip_again.skip()
except msgpack.OutOfData:
    pass

skip_again.feed(b"\x00")
assert skip_again.skip() is None

# Incomplete unpack() followed by unpack()
unpack_again = msgpack.Unpacker()
unpack_again.feed(b"\x91")

try:
    unpack_again.unpack()
except msgpack.OutOfData:
    pass

unpack_again.feed(b"\x00")
assert unpack_again.unpack() == [0]

The crash occurs specifically when the operation changes from an incomplete skip() to unpack().

I found this while fuzzing Python C extension modules.
It looks like a bug to me, so I would appreciate confirmation.

Activity

  1. methane commented on Oct 1, 2026

    @methane
    methane
    on Oct 1, 2026
    Member
    More actions

    fixed in 620b0eb

  2. methane
    closed this as completedon Oct 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      You are visitor 01402503 — GeezerVison does not store the pages you look up.
      Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.