Description

PyCodec_Unregister() reads PyList_GET_SIZE(codec_search_path) for its loop condition before acquiring search_path_mutex, then acquires the mutex and fetches index i with PyList_GetItemRef(). Another unregister call can shorten the list between those operations. The indexed fetch then returns NULL, but the function later calls Py_DECREF(item) unconditionally.

Observed Behavior

Eight threads repeatedly registering and unregistering one search function caused an ASan SEGV on address 0x0c in Py_DECREF() at Python/codecs.c:83 after 0.23 seconds. The same executable completed the four-second GIL-enabled control.

Affected Version

CPython 3.14.7 at commit 823f0323ee6ec1402088b73bce1a38473cac36dc, tested with a free-threaded ASan build.

Reproduction

ASAN_OPTIONS=detect_leaks=0:halt_on_error=1 PYTHON_GIL=0 python3.14 poc/reproduce.py 10

Setting PYTHON_GIL=1 provides the GIL-enabled control.

PoC Source Code

poc/reproduce.py

import codecs
import sys
import threading
import time


duration = float(sys.argv[1]) if len(sys.argv) > 1 else 10.0
stop = threading.Event()


def search(name):
    return None


codecs.register(search)


def exercise():
    while not stop.is_set():
        codecs.unregister(search)
        codecs.register(search)


threads = [threading.Thread(target=exercise) for _ in range(8)]
for thread in threads:
    thread.start()
time.sleep(duration)
stop.set()
for thread in threads:
    thread.join()
print("completed")