GeezerVison is showing github.com — Various UB warnings found by UBSan · Issue #148286 · python/cpython
Various UB warnings found by UBSan #148286Labels extension-modulesC modules in the Modules dirC modules in the Modules dirinterpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error DescriptionBug report
Bug description:
These were all found by UBSan in our CI (it just hasn't been complaining about them). They need to be individually checked, some may be false positives.
# Objects/object.c:97:5: runtime error: member access within null pointer of type 'PyThreadState' (aka 'struct _ts')
null:Objects/object.c
In test_memoryview:
# Objects/memoryobject.c:3032:15: runtime error: load of value 2, which is not a valid value for type 'bool'
bool:Objects/memoryobject.c
In test_ctypes:
# Modules/_ctypes/cfield.c:644:1: runtime error: left shift of 1 by 63 places cannot be represented in type 'int64_t' (aka 'long')
shift-base:Modules/_ctypes/cfield.c
# Modules/_ctypes/cfield.c:640:1: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
signed-integer-overflow:Modules/_ctypes/cfield.c
In test_zstd:
# Modules/_zstd/decompressor.c:598:56: runtime error: applying non-zero offset 18446744073709551615 to null pointer
pointer-overflow:Modules/_zstd/decompressor.c
# Modules/_io/stringio.c:350:24: runtime error: addition of unsigned offset to 0x7fd01ec25850 overflowed to 0x7fd01ec2584c
pointer-overflow:Modules/_io/stringio.c
# Objects/bytesobject.c:1190:25: runtime error: applying zero offset to null pointer
pointer-overflow:Objects/bytesobject.c
CPython versions tested on:
CPython main branch
Operating systems tested on:
No response
Linked PRs
Activitypicnixz commented on Apr 11, 2026 I can confirm the memoryview() UB:
Objects/memoryobject.c:3032:15: runtime error: load of value 2, which is not a valid value for type 'bool'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/memoryobject.c:3032:15
Objects/memoryobject.c:3032:15: runtime error: load of value 2, which is not a valid value for type 'bool'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/memoryobject.c:3032:15
The others look random and probably are so. picnixz commented on Apr 11, 2026 So the memoryview UBSan is more severe than I expected (see #83870 for the past history as well). I will create a new issue. picnixz commented on Apr 11, 2026 For now, I will not investigate the others because I wasn't able to catch them with clang (but it may be other build configurations). added 5 commits that reference this issue on Jul 6, 2026gh-148286: Fix UB in `ZstdDecompressor.unused_data` when a frame is d… matthiasgoergens commented on Jul 30, 2026 While working through the Modules/_ctypes/cfield.c and Modules/_io/stringio.c entries on this list I ran the suppression file against some configurations CI does not currently build, and turned up one more UB site that is not on the list above. Recording it here rather than opening a separate issue, since it is the same class of thing.
Python/uniqueid.c:185, free-threaded builds only. _PyObject_MergePerThreadRefcounts() does refcnt << _Py_REF_SHARED_SHIFT where refcnt is a per-thread delta and is almost always -1. Fix in #154915.
The reason it is not on the list is structural: the sanitizer matrix in .github/workflows/build.yml pairs UBSan only with free-threading: false, so Python/uniqueid.c is never built under UBSan. It is not an obscure path either — the first line of output from ./python -c pass on a --disable-gil --with-undefined-behavior-sanitizer build is the UBSan report, raised during interpreter startup, and it recurs from gc_collect_main on every collection. Over the full suite with all suppressions disabled: 1762 reports, 529 test failures across 61 files, going to zero with the fix.
Two smaller findings from the same sweep, in case they are useful:
local-bounds is not part of the undefined group that --with-undefined-behavior-sanitizer enables, so it runs nowhere today. I built with it enabled and ran the full suite: zero findings, including no false positives from the trailing variable-length array idiom, which was the thing I expected to cause noise. It looks like a free check to add.float-divide-by-zero, also not in the undefined group, produces exactly one hit: Modules/expat/xmlparse.c:869, in vendored libexpat, which deliberately relies on IEEE-754 +inf and says so in a comment, with an assert(newTotal > 0) above guaranteeing it is not NaN. Technically UB in C, intentional in practice — so this one probably is not worth enabling without excluding expat.
Happy to open separate issues for either if that is preferred.
MetadataMetadataextension-modulesC modules in the Modules dirC modules in the Modules dirinterpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error DevelopmentNo branches or pull requestsIssue actions
|