GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Missing `PyErr_NoMemory` in `_zoneinfo` `load_data` and `ts_to_local` · Issue #146092 · python/cpython

Missing PyErr_NoMemory in _zoneinfo load_data and ts_to_local #146092

New issue
Copy link
New issue
Copy link
Closed
Closed
Missing PyErr_NoMemory in _zoneinfo load_data and ts_to_local#146092
Copy link
Labels
3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixes3.15bugs and security fixesbugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

Description

@devdanzin
devdanzin
opened on Mar 17, 2026
Issue body actions

Crash report

What happened?

It's possible to cause assertion errors due to calls returning NULL on OOM in _zoneinfo.

Automated diagnosis:

Multiple PyMem_Malloc/PyMem_Calloc calls in load_data (including ts_to_local at line 2130) return NULL on OOM and goto error without setting an exception. The caller returns NULL without exception → assertion failure.

File: Modules/_zoneinfo.c, lines 1029-1137 (load_data), 2130 (ts_to_local)

MRE for load_data:

import _testcapi, sys

for mod in ["zoneinfo", "_zoneinfo"]:
    if mod in sys.modules:
        del sys.modules[mod]

for n in range(1, 50):
    for mod in ["zoneinfo", "_zoneinfo"]:
        if mod in sys.modules:
            del sys.modules[mod]
    print(n)
    _testcapi.set_nomemory(n, 0)
    try:
        from zoneinfo import ZoneInfo
        z = ZoneInfo("UTC")
        _testcapi.remove_mem_hooks()
        break
    except MemoryError:
        _testcapi.remove_mem_hooks()

MRE for ts_to_local:

import _testcapi
from zoneinfo import ZoneInfo

# Warm up imports — we only want OOM during zone construction
_ = ZoneInfo("UTC")
del _

# Clear cache so America/New_York gets re-loaded from TZif data
ZoneInfo.clear_cache()

# Persistent failure from allocation #9 onward.
# Early allocs (import machinery, arg parsing) succeed;
# the PyMem_Malloc in load_data/ts_to_local fails.
_testcapi.set_nomemory(9, 0)

z = ZoneInfo("America/New_York")  # crashes: assertion `obj != NULL'

Backtrace:

python: ./Include/internal/pycore_stackref.h:554: _PyStackRef PyStackRef_FromPyObjectSteal(PyObject *): Assertion `obj != NULL' failed.

Program received signal SIGABRT, Aborted.

#0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
#3  0x00007ffff7c45e2e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff7c28888 in __GI_abort () at ./stdlib/abort.c:77
#5  0x00007ffff7c287f0 in __assert_fail_base (fmt=<optimized out>, assertion=<optimized out>, file=<optimized out>, line=<optimized out>, function=<optimized out>) at ./assert/assert.c:118
#6  0x00007ffff7c3c19f in __assert_fail (assertion=<optimized out>, file=<optimized out>, line=<optimized out>, function=<optimized out>) at ./assert/assert.c:127
#7  0x000055555587fd55 in PyStackRef_FromPyObjectSteal (obj=<optimized out>) at ./Include/internal/pycore_stackref.h:554
#8  0x0000555555842cd0 in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x555555d99c08 <_PyRuntime+360664>, frame=<optimized out>, frame@entry=0x7ffff7fa70a0, throwflag=throwflag@entry=0)
    at Python/generated_cases.c.h:292
#9  0x000055555583f08b in _PyEval_EvalFrame (tstate=0x555555d99c08 <_PyRuntime+360664>, frame=0x7ffff7fa70a0, throwflag=0) at ./Include/internal/pycore_ceval.h:118
#10 _PyEval_Vector (tstate=0x555555d99c08 <_PyRuntime+360664>, func=0x7ffff75e9190, locals=0x0, args=0x7fffffffb310, argcount=2, kwnames=0x0) at Python/ceval.c:2130
#11 0x00005555556a2ebe in _PyObject_VectorcallTstate (tstate=0x555555d99c08 <_PyRuntime+360664>, callable=callable@entry=0x7ffff75e9190, args=args@entry=0x7fffffffb310,
    nargsf=nargsf@entry=2, kwnames=kwnames@entry=0x0) at ./Include/internal/pycore_call.h:144
#12 0x00005555556a625a in object_vacall (tstate=tstate@entry=0x555555d99c08 <_PyRuntime+360664>, base=base@entry=0x0, callable=callable@entry=0x7ffff75e9190,
    vargs=vargs@entry=0x7fffffffb460) at Objects/call.c:823
#13 0x00005555556a5f0b in PyObject_CallMethodObjArgs (obj=0x7ffff75b08c0, name=0x555555d57470 <_PyRuntime+88384>) at Objects/call.c:960
#14 0x000055555595136b in import_find_and_load (tstate=tstate@entry=0x555555d99c08 <_PyRuntime+360664>, abs_name=abs_name@entry=0x7ffff74f86d0) at Python/import.c:4125
#15 0x0000555555950f66 in PyImport_ImportModuleLevelObject (name=name@entry=0x7ffff74f86d0, globals=globals@entry=0x7ffff746a4b0, locals=locals@entry=0x7ffff746a4b0,
    fromlist=0x7ffff7477cf0, level=level@entry=0) at Python/import.c:4241
#16 0x00005555558f7265 in _PyEval_ImportNameWithImport (tstate=tstate@entry=0x555555d99c08 <_PyRuntime+360664>, import_func=0x7ffff75be9f0, globals=globals@entry=0x7ffff746a4b0,
    locals=locals@entry=0x7ffff746a4b0, name=name@entry=0x7ffff74f86d0, fromlist=fromlist@entry=0x7ffff7477cf0, level=0x555555d49188 <_PyRuntime+30296>) at Python/ceval.c:2975
#17 0x00005555558848bf in _PyEval_ImportName (tstate=tstate@entry=0x555555d99c08 <_PyRuntime+360664>, builtins=0x7ffff75be930, globals=0x7ffff746a4b0, locals=0x7ffff746a4b0,
    name=0x7ffff74f86d0, fromlist=0x7ffff7477cf0, level=0x555555d49188 <_PyRuntime+30296>) at Python/ceval.c:2954
#18 0x000055555586141a in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x555555d99c08 <_PyRuntime+360664>, frame=<optimized out>, frame@entry=0x7ffff7fa7020, throwflag=throwflag@entry=0)
    at Python/generated_cases.c.h:6460
#19 0x000055555583f08b in _PyEval_EvalFrame (tstate=0x555555d99c08 <_PyRuntime+360664>, frame=0x7ffff7fa7020, throwflag=0) at ./Include/internal/pycore_ceval.h:118
#20 _PyEval_Vector (tstate=tstate@entry=0x555555d99c08 <_PyRuntime+360664>, func=func@entry=0x7ffff7466690, locals=locals@entry=0x7ffff746a4b0, args=args@entry=0x0,
    argcount=argcount@entry=0, kwnames=kwnames@entry=0x0) at Python/ceval.c:2130
#21 0x000055555583ee1e in PyEval_EvalCode (co=co@entry=0x555555f3baf0, globals=globals@entry=0x7ffff746a4b0, locals=locals@entry=0x7ffff746a4b0) at Python/ceval.c:686
#22 0x00005555559c8f8e in run_eval_code_obj (tstate=0x555555d99c08 <_PyRuntime+360664>, co=co@entry=0x555555f3baf0, globals=globals@entry=0x7ffff746a4b0, locals=locals@entry=0x7ffff746a4b0)
    at Python/pythonrun.c:1368
#23 0x00005555559c8adb in run_mod (mod=mod@entry=0x555555f43b30, filename=filename@entry=0x7ffff74e8580, globals=globals@entry=0x7ffff746a4b0, locals=locals@entry=0x7ffff746a4b0,
    flags=0x7fffffffc950, arena=arena@entry=0x7ffff74dad40, interactive_src=0x0, generate_new_source=0) at Python/pythonrun.c:1471

Found using cpython-review-toolkit with Claude Opus 4.6, using the /cpython-review-toolkit:explore Modules/_zoneinfo.c all deep command.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.15.0a7+ (heads/main:e0f7c1097e1, Mar 17 2026, 18:10:52) [Clang 21.1.2 (2ubuntu6)]

Linked PRs

  • gh-146092: Fix error handling in _BINARY_OP_ADD_UNICODE opcode #146117
  • [3.14] gh-146092: Fix error handling in _BINARY_OP_ADD_FLOAT opcode #146119
  • gh-146092: Handle _PyFrame_GetFrameObject() failures properly #146124
  • [3.14] gh-146092: Handle _PyFrame_GetFrameObject() failures properly (#146124) #146132
  • [3.13] gh-146092: Handle _PyFrame_GetFrameObject() failures properly (GH-146124) (GH-146132) #146138
  • gh-146092: Raise MemoryError on allocation failure in _zoneinfo #146165
  • [3.14] gh-146092: Raise MemoryError on allocation failure in _zoneinfo (GH-146165) #146223
  • [3.13] gh-146092: Raise MemoryError on allocation failure in _zoneinfo (GH-146165) #146224

Activity

Next
  1. devdanzin
    added
    type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
    extension-modulesC modules in the Modules dirC modules in the Modules dir
    on Mar 17, 2026
  2. StanFromIreland
    added this to Date and time issues 🕰️on Mar 18, 2026
  3. vstinner
    added a commit that references this issue on Mar 18, 2026

    pythongh-146092: Fix error handling in _BINARY_OP_ADD_UNICODE opcode

    e7379c0
  4. serhiy-storchaka
    added a parent issue on Mar 18, 2026
    • Umbrella issue: bugs found using cpython-review-toolkit #146102
  5. vstinner commented on Mar 18, 2026

    @vstinner
    vstinner
    on Mar 18, 2026
    Member
    More actions

    MRE for ts_to_local

    This script triggers a bug in Python/ceval.c, not in Modules/_zoneinfo.c. I wrote #146117 to fix this unrelated bug.

    Reacted by Stan Ulbrych
  6. serhiy-storchaka
    added
    3.13only security fixesonly security fixes
    3.14bugs and security fixesbugs and security fixes
    3.15bugs and security fixesbugs and security fixes
    on Mar 18, 2026
  7. vstinner
    added a commit that references this issue on Mar 18, 2026

    pythongh-146092: Fix error handling in _BINARY_OP_ADD_FLOAT opcode

    a14e2c2
  8. StanFromIreland
    added
    interpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)
    and removed
    extension-modulesC modules in the Modules dirC modules in the Modules dir
    on Mar 18, 2026
  9. StanFromIreland
    removed this from Date and time issues 🕰️on Mar 18, 2026
  10. vstinner
    added 2 commits that reference this issue on Mar 18, 2026

    pythongh-146092: Fix error handling in _BINARY_OP_ADD_FLOAT opcode

    3bd1e9d

    gh-146092: Fix error handling in _BINARY_OP_ADD_UNICODE opcode (#146117)

    1e4ed93
  11. 7 remaining items

  12. vstinner
    added 3 commits that reference this issue on Mar 18, 2026

    [3.13] gh-146092: Handle _PyFrame_GetFrameObject() failures properly (G…

    53b544a

    [3.14] gh-146092: Fix error handling in _BINARY_OP_ADD_FLOAT opcode (#…

    7f29c1d

    pythongh-146092: Raise MemoryError on allocation failure in _zoneinfo

    5d51fa9
  13. vstinner commented on Mar 19, 2026

    @vstinner
    vstinner
    on Mar 19, 2026
    Member
    More actions

    Multiple PyMem_Malloc/PyMem_Calloc calls in load_data (including ts_to_local at line 2130) return NULL on OOM and goto error without setting an exception. The caller returns NULL without exception → assertion failure.

    I wrote #146165 to raise MemoryError on memory allocation failures.

  14. vstinner
    added a commit that references this issue on Mar 20, 2026

    gh-146092: Raise MemoryError on allocation failure in _zoneinfo (#146165

    6450b1d
  15. miss-islington
    added 2 commits that reference this issue on Mar 20, 2026

    pythongh-146092: Raise MemoryError on allocation failure in _zoneinfo (…

    8403da2

    pythongh-146092: Raise MemoryError on allocation failure in _zoneinfo (…

    8025e78
  16. vstinner commented on Mar 20, 2026

    @vstinner
    vstinner
    on Mar 20, 2026
    Member
    More actions

    Thanks for your bug report. It should be fixed by 6450b1d.

  17. vstinner
    closed this as completedon Mar 20, 2026
  18. vstinner
    added 2 commits that reference this issue on Mar 20, 2026

    [3.13] gh-146092: Raise MemoryError on allocation failure in _zoneinfo (

    cfd7f94

    [3.14] gh-146092: Raise MemoryError on allocation failure in _zoneinfo (

    a2a45d7
  19. CuriousLearner
    added a commit that references this issue on Mar 22, 2026

    Merge remote-tracking branch 'upstream/main' into fix-pythongh-138577

    2691ad9
  20. ljfp
    added 3 commits that reference this issue on Apr 25, 2026

    pythongh-146092: Fix error handling in _BINARY_OP_ADD_UNICODE opcode (p…

    4f4627f

    pythongh-146092: Handle _PyFrame_GetFrameObject() failures properly (p…

    5fdfa41

    pythongh-146092: Raise MemoryError on allocation failure in _zoneinfo (…

    bd94f64
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixes3.15bugs and security fixesbugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      You are visitor 01402503 — GeezerVison does not store the pages you look up.
      Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.