GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — AddressSanitizer: global-buffer-overflow `Modules/_decimal/_decimal.c:798:37` in `signaldict_richcompare` · Issue #158063 · python/cpython

AddressSanitizer: global-buffer-overflow `Modules/_decimal/_decimal.c:798:37` in `signaldict_richcompare` #158063

New issue

Copy link

New issue

Copy link

Open

AddressSanitizer: global-buffer-overflow Modules/_decimal/_decimal.c:798:37 in signaldict_richcompare#158063

Copy link

Labels

extension-modulesC modules in the Modules dirC modules in the Modules dirtype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

Description

YuanchengJiang

opened

on Sep 24, 2026

Issue body actions

Crash report

What happened?

The following code:

import decimal
decimal.getcontext().flags == None

Resulted in this output:

=================================================================
==94==ERROR: AddressSanitizer: global-buffer-overflow on address 0x5edfef9969b0 at pc 0x73e5cad1557b bp 0x7ffeed18d9d0 sp 0x7ffeed18d9c8
READ of size 8 at 0x5edfef9969b0 thread T0
    #0 0x73e5cad1557a in signaldict_richcompare /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/_decimal/_decimal.c:798:37
    #1 0x5edfee58d26a in do_richcompare /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Objects/object.c:1065:15
    #2 0x5edfee58d26a in PyObject_RichCompare /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Objects/object.c:1114:21
    #3 0x5edfee92fccc in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/generated_cases.c.h:5281:35
    #4 0x5edfee905371 in _PyEval_Vector /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/ceval.c:2176:12
    #5 0x5edfee905371 in PyEval_EvalCode /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/ceval.c:681:21
    #6 0x5edfeeeca0fa in run_eval_code_obj /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/pythonrun.c:1406:12
    #7 0x5edfeeec981c in run_mod /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/pythonrun.c:1509:19
    #8 0x5edfeeec451c in _PyRun_File /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/pythonrun.c:1332:15
    #9 0x5edfeeec27ef in _PyRun_SimpleFile /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/pythonrun.c:544:15
    #10 0x5edfeeec1e47 in _PyRun_AnyFile /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/pythonrun.c:92:18
    #11 0x5edfeef8d8af in pymain_run_file_obj /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/main.c:478:24
    #12 0x5edfeef8d8af in pymain_run_file /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/main.c:494:20
    #13 0x5edfeef8c028 in pymain_run_python /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/main.c:804:21
    #14 0x5edfeef8c028 in Py_RunMain /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/main.c:891:5
    #15 0x5edfeef8d057 in pymain_main /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/main.c:921:12
    #16 0x5edfeef8d2bf in Py_BytesMain /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/main.c:945:12
    #17 0x77e5cb9ced8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #18 0x77e5cb9cee3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #19 0x5edfedef9334 in _start (/home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/python+0x9fd334) (BuildId: ca90491e49290c487356a96661cf4fa97186159f)

0x5edfef9969b0 is located 16 bytes before global variable 'notimplemented_as_number' defined in '/home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Objects/object.c:2450' (0x5edfef9969c0) of size 288
0x5edfef9969b0 is located 0 bytes after global variable '_Py_NoneStruct' defined in '/home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Objects/object.c:2400' (0x5edfef9969a0) of size 16
SUMMARY: AddressSanitizer: global-buffer-overflow /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/_decimal/_decimal.c:798:37 in signaldict_richcompare
Shadow bytes around the buggy address:
  0x5edfef996700: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 f9
  0x5edfef996780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x5edfef996800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x5edfef996880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x5edfef996900: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
=>0x5edfef996980: f9 f9 f9 f9 00 00[f9]f9 00 00 00 00 00 00 00 00
  0x5edfef996a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x5edfef996a80: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9
  0x5edfef996b00: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x5edfef996b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x5edfef996c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==94==ABORTING
./test.sh: line 3:    94 Aborted                 (core dumped)

This bug was found by fusion-fuzz

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

No response

Linked PRs

gh-158063: Fix out-of-bounds read when comparing decimal signal dicts #158069

Activity

YuanchengJiang
added
type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
on Sep 24, 2026
hosu3das20s05s commented on Sep 24, 2026
hosu3das20s05s
on Sep 24, 2026 via email
More actions
Thank you. I'll take a look.
…

On Thu, Sep 24, 2026 at 10:26 AM JIANG Yuancheng ***@***.***> wrote: *YuanchengJiang* created an issue (python/cpython#158063) <#158063> Crash report What happened? The following code: import decimaldecimal.getcontext().flags == None Resulted in this output: ================================================================= ==94==ERROR: AddressSanitizer: global-buffer-overflow on address 0x5edfef9969b0 at pc 0x73e5cad1557b bp 0x7ffeed18d9d0 sp 0x7ffeed18d9c8 READ of size 8 at 0x5edfef9969b0 thread T0 #0 0x73e5cad1557a in signaldict_richcompare /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/_decimal/_decimal.c:798:37 #1 0x5edfee58d26a in do_richcompare /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Objects/object.c:1065:15 #2 0x5edfee58d26a in PyObject_RichCompare /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Objects/object.c:1114:21 #3 0x5edfee92fccc in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/generated_cases.c.h:5281:35 #4 0x5edfee905371 in _PyEval_Vector /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/ceval.c:2176:12 #5 0x5edfee905371 in PyEval_EvalCode /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/ceval.c:681:21 #6 0x5edfeeeca0fa in run_eval_code_obj /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/pythonrun.c:1406:12 #7 0x5edfeeec981c in run_mod /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/pythonrun.c:1509:19 #8 0x5edfeeec451c in _PyRun_File /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/pythonrun.c:1332:15 #9 0x5edfeeec27ef in _PyRun_SimpleFile /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/pythonrun.c:544:15 #10 0x5edfeeec1e47 in _PyRun_AnyFile /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/pythonrun.c:92:18 #11 0x5edfeef8d8af in pymain_run_file_obj /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/main.c:478:24 #12 0x5edfeef8d8af in pymain_run_file /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/main.c:494:20 #13 0x5edfeef8c028 in pymain_run_python /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/main.c:804:21 #14 0x5edfeef8c028 in Py_RunMain /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/main.c:891:5 #15 0x5edfeef8d057 in pymain_main /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/main.c:921:12 #16 0x5edfeef8d2bf in Py_BytesMain /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/main.c:945:12 #17 0x77e5cb9ced8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #18 0x77e5cb9cee3f in __libc_start_main csu/../csu/libc-start.c:392:3 #19 0x5edfedef9334 in _start (/home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/python+0x9fd334) (BuildId: ca90491e49290c487356a96661cf4fa97186159f) 0x5edfef9969b0 is located 16 bytes before global variable 'notimplemented_as_number' defined in '/home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Objects/object.c:2450' (0x5edfef9969c0) of size 288 0x5edfef9969b0 is located 0 bytes after global variable '_Py_NoneStruct' defined in '/home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Objects/object.c:2400' (0x5edfef9969a0) of size 16 SUMMARY: AddressSanitizer: global-buffer-overflow /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/_decimal/_decimal.c:798:37 in signaldict_richcompare Shadow bytes around the buggy address: 0x5edfef996700: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 f9 0x5edfef996780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x5edfef996800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x5edfef996880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x5edfef996900: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 =>0x5edfef996980: f9 f9 f9 f9 00 00[f9]f9 00 00 00 00 00 00 00 00 0x5edfef996a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x5edfef996a80: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 0x5edfef996b00: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 0x5edfef996b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x5edfef996c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==94==ABORTING ./test.sh: line 3: 94 Aborted (core dumped) *This bug was found by fusion-fuzz <https://github.com/fusion-fuzz/fusion-fuzz>* CPython versions tested on: CPython main branch Operating systems tested on: Linux Output from running 'python -VV' on the command line: *No response* — Reply to this email directly, view it on GitHub <#158063?email_source=notifications&email_token=CJH4FSQTX2QRAR674XEPR7L5QTSE5A5CNFSL4Z3JMQ5C6L3HNF2C22DVMIXUS43TOVSS6NJVGY3DEMBRGMZDRJTSMVQXG33OVJZXKYTTMNZGSYTFMSSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/CJH4FSVCSWCQGKIASEZRFIT5QTSE5AVCNFSNUABEKJSXA33TNF2G64TZHM4DCNJZHA4TMMJ3JFZXG5LFHM2TKNRWGIYDCMZSHCQXMAQ> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/CJH4FSRPZPMN5UMRCEOQV535QTSE5A5CNFSL4Z3JMQ5C6L3HNF2C22DVMIXUS43TOVSS6NJVGY3DEMBRGMZDRJTSMVQXG33OVJZXKYTTMNZGSYTFMSSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/CJH4FSTVNU3XRKLUU4SNPZT5QTSE5A5CNFSL4Z3JMQ5C6L3HNF2C22DVMIXUS43TOVSS6NJVGY3DEMBRGMZDRJTSMVQXG33OVJZXKYTTMNZGSYTFMSSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>
zzffeggs commented on Sep 24, 2026
zzffeggs
on Sep 24, 2026 via email
More actions
Thank you for bringing this to my attention. On Thu, Sep 24, 2026 at 10:38 AM hosu3das20s05s ***@***.***> wrote:
…

*hosu3das20s05s* left a comment (python/cpython#158063) <#158063 (comment)> Thank you. I'll take a look. On Thu, Sep 24, 2026 at 10:26 AM JIANG Yuancheng ***@***.***> wrote: > *YuanchengJiang* created an issue (python/cpython#158063) > <#158063> > Crash report What happened? > > The following code: > > import decimaldecimal.getcontext().flags == None > > Resulted in this output: > > ================================================================= > ==94==ERROR: AddressSanitizer: global-buffer-overflow on address 0x5edfef9969b0 at pc 0x73e5cad1557b bp 0x7ffeed18d9d0 sp 0x7ffeed18d9c8 > READ of size 8 at 0x5edfef9969b0 thread T0 > #0 0x73e5cad1557a in signaldict_richcompare /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/_decimal/_decimal.c:798:37 > #1 0x5edfee58d26a in do_richcompare /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Objects/object.c:1065:15 > #2 0x5edfee58d26a in PyObject_RichCompare /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Objects/object.c:1114:21 > #3 0x5edfee92fccc in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/generated_cases.c.h:5281:35 > #4 0x5edfee905371 in _PyEval_Vector /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/ceval.c:2176:12 > #5 0x5edfee905371 in PyEval_EvalCode /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/ceval.c:681:21 > #6 0x5edfeeeca0fa in run_eval_code_obj /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/pythonrun.c:1406:12 > #7 0x5edfeeec981c in run_mod /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/pythonrun.c:1509:19 > #8 0x5edfeeec451c in _PyRun_File /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/pythonrun.c:1332:15 > #9 0x5edfeeec27ef in _PyRun_SimpleFile /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/pythonrun.c:544:15 > #10 0x5edfeeec1e47 in _PyRun_AnyFile /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Python/pythonrun.c:92:18 > #11 0x5edfeef8d8af in pymain_run_file_obj /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/main.c:478:24 > #12 0x5edfeef8d8af in pymain_run_file /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/main.c:494:20 > #13 0x5edfeef8c028 in pymain_run_python /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/main.c:804:21 > #14 0x5edfeef8c028 in Py_RunMain /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/main.c:891:5 > #15 0x5edfeef8d057 in pymain_main /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/main.c:921:12 > #16 0x5edfeef8d2bf in Py_BytesMain /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/main.c:945:12 > #17 0x77e5cb9ced8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 > #18 0x77e5cb9cee3f in __libc_start_main csu/../csu/libc-start.c:392:3 > #19 0x5edfedef9334 in _start (/home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/python+0x9fd334) (BuildId: ca90491e49290c487356a96661cf4fa97186159f) > > 0x5edfef9969b0 is located 16 bytes before global variable 'notimplemented_as_number' defined in '/home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Objects/object.c:2450' (0x5edfef9969c0) of size 288 > 0x5edfef9969b0 is located 0 bytes after global variable '_Py_NoneStruct' defined in '/home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Objects/object.c:2400' (0x5edfef9969a0) of size 16 > SUMMARY: AddressSanitizer: global-buffer-overflow /home/fuzz/WorkSpace/fusion-fuzz/projects/cpython/cpython/build/../Modules/_decimal/_decimal.c:798:37 in signaldict_richcompare > Shadow bytes around the buggy address: > 0x5edfef996700: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 f9 > 0x5edfef996780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 0x5edfef996800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 0x5edfef996880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 0x5edfef996900: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 > =>0x5edfef996980: f9 f9 f9 f9 00 00[f9]f9 00 00 00 00 00 00 00 00 > 0x5edfef996a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 0x5edfef996a80: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 > 0x5edfef996b00: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 > 0x5edfef996b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 0x5edfef996c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > Shadow byte legend (one shadow byte represents 8 application bytes): > Addressable: 00 > Partially addressable: 01 02 03 04 05 06 07 > Heap left redzone: fa > Freed heap region: fd > Stack left redzone: f1 > Stack mid redzone: f2 > Stack right redzone: f3 > Stack after return: f5 > Stack use after scope: f8 > Global redzone: f9 > Global init order: f6 > Poisoned by user: f7 > Container overflow: fc > Array cookie: ac > Intra object redzone: bb > ASan internal: fe > Left alloca redzone: ca > Right alloca redzone: cb > ==94==ABORTING > ./test.sh: line 3: 94 Aborted (core dumped) > > *This bug was found by fusion-fuzz > <https://github.com/fusion-fuzz/fusion-fuzz>* > CPython versions tested on: > > CPython main branch > Operating systems tested on: > > Linux > Output from running 'python -VV' on the command line: > > *No response* > > — > Reply to this email directly, view it on GitHub > < #158063?email_source=notifications&email_token=CJH4FSQTX2QRAR674XEPR7L5QTSE5A5CNFSL4Z3JMQ5C6L3HNF2C22DVMIXUS43TOVSS6NJVGY3DEMBRGMZDRJTSMVQXG33OVJZXKYTTMNZGSYTFMSSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L>, > or unsubscribe > < https://github.com/notifications/unsubscribe-auth/CJH4FSVCSWCQGKIASEZRFIT5QTSE5AVCNFSNUABEKJSXA33TNF2G64TZHM4DCNJZHA4TMMJ3JFZXG5LFHM2TKNRWGIYDCMZSHCQXMAQ> > . > Triage notifications, keep track of coding agent tasks and review pull > requests on the go with GitHub Mobile for iOS > < https://github.com/notifications/mobile/ios/CJH4FSRPZPMN5UMRCEOQV535QTSE5A5CNFSL4Z3JMQ5C6L3HNF2C22DVMIXUS43TOVSS6NJVGY3DEMBRGMZDRJTSMVQXG33OVJZXKYTTMNZGSYTFMSSWK5TFNZ2KUZTPN52GK4S7NFXXG> > and Android > < https://github.com/notifications/mobile/android/CJH4FSTVNU3XRKLUU4SNPZT5QTSE5A5CNFSL4Z3JMQ5C6L3HNF2C22DVMIXUS43TOVSS6NJVGY3DEMBRGMZDRJTSMVQXG33OVJZXKYTTMNZGSYTFMSSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. > Download it today! > You are receiving this because you are subscribed to this thread.Message > ID: ***@***.***> > — Reply to this email directly, view it on GitHub <#158063?email_source=notifications&email_token=CI24R3PGCNIE7JOGDFMYNE35QTTQVA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKOBRGE3DIOJRGU42M4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSWGM33PORSXEX3DNRUWG2Y#issuecomment-5811649159>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/CI24R3OWHCKYLM735OLOY3D5QTTQVAVCNFSNUABEKJSXA33TNF2G64TZHM4DCNJZHA4TMMJ3JFZXG5LFHM2TKNRWGIYDCMZSHCQXMAQ> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/CI24R3PIKACWAMKUMIL4XVL5QTTQVA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKOBRGE3DIOJRGU42M4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSVGM33PORSXEX3JN5ZQ> and Android <https://github.com/notifications/mobile/android/CI24R3P7YHUCKPDUAPZTPQT5QTTQVA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKOBRGE3DIOJRGU42M4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSXGM33PORSXEX3BNZSHE33JMQ>. Download it today! You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>
picnixz
closed this as a duplicateof _decimal::CURRENT_CONTEXT: UAF via borrowed reference across Python callbacks #148382 on Sep 24, 2026
picnixz
reopened this on Sep 24, 2026
picnixz commented on Sep 24, 2026
picnixz
on Sep 24, 2026
Member
More actions
I wanted to link it to the other issue in general, mb. I think we have a general issue about the signal dict though?
picnixz
added
extension-modulesC modules in the Modules dirC modules in the Modules dir
on Sep 24, 2026
StanFromIreland
changed the title ~~[-]AddressSanitizer: global-buffer-overflow cpython/build/../Modules/_decimal/_decimal.c:798:37 in signaldict_richcompare[/-]~~ [+]AddressSanitizer: global-buffer-overflow `Modules/_decimal/_decimal.c:798:37` in `signaldict_richcompare`[/+] on Sep 24, 2026
kevinprimeraquecreo-stack
added this to Project_VKon Oct 18, 2026
github-project-automation
moved this to Todo in Project_VKon Oct 18, 2026
kevinprimeraquecreo-stack
added this to Project_VKon Oct 18, 2026
grgalex commented on Nov 11, 2026
grgalex
on Nov 11, 2026
Contributor
More actions
Just wanted to add that I also independently bumped into this, and can reproduce even without ASAN:

The outcome depends on the operand: {}, (), "" and [] raise, while 1 or object() answer False.

_pydecimal returns False for all of them.

import decimal ctx = decimal.Context() print(ctx.flags == {})

ValueError: invalid signal dict

Metadata

Assignees

No one assigned

Labels

extension-modulesC modules in the Modules dirC modules in the Modules dirtype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

AddressSanitizer: global-buffer-overflow Modules/_decimal/_decimal.c:798:37 in signaldict_richcompare #158063

Description

Crash report

What happened?

CPython versions tested on:

Operating systems tested on:

Output from running 'python -VV' on the command line:

Linked PRs

Activity

hosu3das20s05s commented on Sep 24, 2026

zzffeggs commented on Sep 24, 2026

picnixz commented on Sep 24, 2026

grgalex commented on Nov 11, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

AddressSanitizer: global-buffer-overflow `Modules/_decimal/_decimal.c:798:37` in `signaldict_richcompare` #158063