GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — _interpqueuesmodule.c: Use-after-free from dangling items.last pointer · Issue #146427 · python/cpython

_interpqueuesmodule.c: Use-after-free from dangling items.last pointer #146427

New issue
Copy link
New issue
Copy link
Open
Open
_interpqueuesmodule.c: Use-after-free from dangling items.last pointer#146427
Copy link
Labels
extension-modulesC modules in the Modules dirC modules in the Modules dirtopic-subinterpreterstype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

Description

@aisk
aisk
opened on Mar 25, 2026
Issue body actions

Crash report

What happened?

Summary

_queue_clear_interpreter in Modules/_interpqueuesmodule.c (lines 739-774) never updates queue->items.last when removing the tail item. After the item is freed, items.last is a dangling pointer. Next queue operation writes to freed memory.

I have a working patch on this issue, will sending the PR later.

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Output from running 'python -VV' on the command line:

No response

Linked PRs

  • gh-146427: Fix use-after-free when clearing interpreter's queue items #146428

Activity

  1. aisk
    added
    type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
    on Mar 25, 2026
  2. aisk
    added a parent issue on Mar 25, 2026
    • Umbrella issue: bugs found using cpython-review-toolkit #146102
  3. aisk
    added
    extension-modulesC modules in the Modules dirC modules in the Modules dir
    topic-subinterpreters
    on Mar 25, 2026
  4. github-project-automation
    added this to Subinterpreterson Mar 25, 2026
  5. github-project-automation
    moved this to Todo in Subinterpreterson Mar 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    extension-modulesC modules in the Modules dirC modules in the Modules dirtopic-subinterpreterstype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

    Projects

    • Subinterpreters
      Status
      Todo
      Show more project fields

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions
    You are visitor 01402503 — GeezerVison does not store the pages you look up.
    Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.