GeezerVison is showing github.com — Umbrella issue: bugs found using cpython-review-toolkit · Issue #146102 · python/cpython
Umbrella issue: bugs found using cpython-review-toolkit #146102Open 35 / 4135 of 41 issues completedOpen 35 / 4135 of 41 issues completed Labels extension-modulesC modules in the Modules dirC modules in the Modules dirinterpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or errortype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump DescriptionBug report
What happened?
This is an umbrella issue for 50 select bugs found using cpython-review-toolkit, distributed across ~350K lines of CPython C code (Modules/, Objects/, Python/).
Feel free to work on any report, opening an issue if one doesn't exist yet. Comment with the issue and respective gist/bug here and I'll update the table. If you find an issue listed below that is a duplicate of an existing report, let me know and I'll also mark it in the table.
Modules/ (18 gists)
| Gist |
Description |
CPython Issue |
| gist |
_ssl.c: Py_DECREF(NULL) in SNI callback |
#146080 FIXED |
| gist |
_sqlite: collation assertion + missing PyErr_NoMemory |
#146090 FIXED |
| gist |
functools partial PyDict_Contains -1 as truthy |
#146075 FIXED |
| gist |
_csv.c: _set_str missing NULL check |
#146093 FIXED |
| gist |
_zoneinfo: SEGV in get_weak_cache |
#146076 FIXED |
| gist |
_zoneinfo: missing PyErr_NoMemory in load_data |
#146092 FIXED |
| gist |
termios: NULL to PyLong_AsLong |
#146091 FIXED |
| gist |
_struct: segfault/assertion on uninitialized Struct |
Fixed in 515ae40 |
| gist |
pyexpat: ExternalEntityParserCreate crash |
Fixed in e6b9a14 |
| gist |
_interpqueuesmodule: use-after-free dangling last |
#146427 |
| gist |
selectmodule: errno < 0 always false |
#146205 FIXED |
| gist |
_lsprof: exception clobbering |
#153068 FIXED |
| gist |
deque.copy() ref corruption on OOM |
#152017 |
| gist |
readline: begidx NULL on OOM |
#154385 |
| gist |
zlibmodule: PyErr_NewException unchecked |
false alarm |
| gist |
socketmodule: audit hook ref/buffer leaks |
#146245 FIXED |
| gist |
_interpchannelsmodule: missing PyErr_NoMemory |
#150213 FIXED |
| gist |
_interpretersmodule: SEGV on create under OOM |
Fixed in d06113c |
Objects/ (13 gists)
| Gist |
Description |
CPython Issue |
| gist |
ExceptionGroup repr OOB — 3-line segfault |
#146096 FIXED |
| gist |
SyntaxError.__init__ ref leaks on re-init |
#146250 FIXED |
| gist |
codeobject: code_richcompare swallows errors |
#146199 FIXED |
| gist |
codeobject: co_tlbc NULL + replacement_locations leak |
— |
| gist |
weakref WRAP_BINARY ref leak (~20 operators) |
#153058 |
| gist |
FrameLocalsProxy swallows/overwrites errors |
— |
| gist |
typeobject: missing return -1 in type_ready |
commit c398490 |
| gist |
typeobject: buffer leak in slot_bf_getbuffer |
#151346 FIXED |
| gist |
object.c: PyObject_Print missing LeaveRecursiveCall |
commit e2fa10e |
| gist |
structseq: get_type_attr_as_size NULL deref |
#148119 FIXED |
| gist |
genericaliasobject: two NULL dereference bugs |
#148226 FIXED |
| gist |
odictobject: spurious PyErr_Clear |
#151347 FIXED |
| gist |
unicode_format: wrong return + PY_SSIZE_T_MIN UB |
#151845 #151847 |
Python/ (16 gists)
| Gist |
Description |
CPython Issue |
| gist |
import.c: wrong interpreter + double lock release |
#150454 #150374 FIXED |
| gist |
instrumentation.c: PyLong leak per monitoring call |
#150379 FIXED |
| gist |
instrumentation.c: use-after-Py_DECREF comparison |
#151524 |
| gist |
ceval.c: missing PyErr_NoMemory + PyEval_GetLocals NULL |
#153205 FIXED |
| gist |
bltinmodule: __lazy_import__ NULL deref |
#151510 FIXED |
| gist |
crossinterp: UAF + leaked exception + shadowed var |
— |
| gist |
compiler pipeline: 6 ref leaks and error bugs |
#146442 FIXED |
| gist |
marshal: 8 refs leaked on corrupt TYPE_CODE |
#148418 FIXED |
| gist |
pylifecycle: 5 init/fini cleanup bugs |
— |
| gist |
initconfig: SET_ITEM macro leaks dict |
#146244 FIXED |
| gist |
ast.c: LEAVE_RECURSIVE missing on 30 paths |
— |
| gist |
hamt.c: sub_node leaked in bitmap ops |
#150178 |
| gist |
pythonrun: main_module ref leak |
#146355 FIXED |
| gist |
modsupport: missing va_end (UB) |
#146386 FIXED |
| gist |
legacy_tracing: unchecked PyLong_AsInt |
#153622 |
| gist |
optimizer_symbols: make_bottom NULL deref |
#146388 FIXED |
Duplicates (3 gists — same bugs uploaded from different runs)
| Gist |
Duplicate of |
| gist |
ExceptionGroup repr (dup of dceaa8b7) |
| gist |
sqlite collation (dup of 69aff7ff) |
| gist |
SSL SNI (dup of 50f98806) |
These issues were found with Claude Opus 4.6, using the /cpython-review-toolkit:explore [file or directory] all deep command.
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Output from running 'python -VV' on the command line:
Python 3.15.0a7+ (heads/main:e0f7c1097e1, Mar 17 2026, 18:10:52) [Clang 21.1.2 (2ubuntu6)]
Linked PRs
Reacted by Kirill Podoprigora, Sergey Miryanov, Brij Kapadia, Wulian233, An Long, Brandon, Yongtao Huang and sunmy2019 Activitylpyu001 commented on Jul 24, 2026 PR #150549 fixs "codeobject: co_tlbc NULL + replacement_locations leak” fixed
PR #153421 fixs “FrameLocalsProxy swallows/overwrites errors”
PR #151578 fixs “crossinterp: UAF + leaked exception + shadowed var”
MetadataMetadataextension-modulesC modules in the Modules dirC modules in the Modules dirinterpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or errortype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump DevelopmentNo branches or pull requestsIssue actions
|