Description

devdanzin

opened on Mar 17, 2026

Issue body actions

Crash report

What happened?

It's possible to raise SystemError from termios.tcsetwinsize by passing a sequence that raises on __getitem__ to it.

Automated diagnosis:

Bug: termios.tcsetwinsize passes NULL to PyLong_AsLong. PySequence_GetItem(winsz, 0) can return NULL (e.g., __getitem__ raises). The result is passed directly to PyLong_AsLong(NULL) which calls PyErr_BadInternalCall(), masking the real error with SystemError.

File: Modules/termios.c, lines 502-510

MRE:

import termios
import os

fd = os.open("/dev/tty", os.O_RDWR | os.O_NOCTTY)

class BadSequence:
    def __len__(self):
        return 2
    def __getitem__(self, idx):
        raise TypeError

termios.tcsetwinsize(fd, BadSequence())

Backtrace:

Traceback (most recent call last):
  File "/home/danzin/crashers/trigger_termios_null_pylong.py", line 23, in <module>
    termios.tcsetwinsize(fd, BadSequence())
    ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
SystemError: Objects/longobject.c:598: bad argument to internal function

Found using cpython-review-toolkit with Claude Opus 4.6, using the /cpython-review-toolkit:explore Modules/termios.c all deep command.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.15.0a7+ (heads/main:e0f7c1097e1, Mar 17 2026, 18:10:52) [Clang 21.1.2 (2ubuntu6)]

Linked PRs

• gh-146091: Fix NULL check in termios.tcsetwinsize #146147

Activity

1. devdanzin

   added

   extension-modulesC modules in the Modules dirC modules in the Modules dir

   type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

   on Mar 17, 2026
2. serhiy-storchaka

   added a parent issue on Mar 18, 2026

   • Umbrella issue: bugs found using cpython-review-toolkit #146102
3. serhiy-storchaka

   added

   3.13only security fixesonly security fixes

   3.14bugs and security fixesbugs and security fixes

   3.15bugs and security fixesbugs and security fixes

   on Mar 18, 2026
4. okiemute04 commented on Mar 18, 2026

   

   okiemute04

   on Mar 18, 2026

   Contributor

   More actions

   @devdanzin This is interesting. Let me work on this issue. I do understand the problem is that PySequence_GetItem can return NULL, which gets passed to PyLong_AsLong, causing a SystemError instead of the original exception. I'll add NULL checks and proper error propagation, and any suggestions that can help?
5. okiemute04

   added 3 commits that reference this issue on Mar 18, 2026

   pythongh-146091: Fix NULL check in termios.tcsetwinsize

   ae90cb1

   pythongh-146091: Fix NULL check in termios.tcsetwinsize

   5e8ef92

   pythongh-146091: Fix NULL check in termios.tcsetwinsize

   113df89
6. kumaraditya303

   added a commit that references this issue on Mar 19, 2026

   gh-146091: Fix NULL check in termios.tcsetwinsize (#146147)

   89a154a
7. kumaraditya303

   closed this as completedin #146147on Mar 19, 2026
8. ljfp

   added a commit that references this issue on Apr 25, 2026

   pythongh-146091: Fix NULL check in termios.tcsetwinsize (python#146147)

   2f8f8bc

Issue actions