GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Marshal Stacksize Integer Overflow leading to Frame Crash · Issue #158648 · python/cpython

Marshal Stacksize Integer Overflow leading to Frame Crash #158648

New issue
Copy link
New issue
Copy link
Open
Open
Marshal Stacksize Integer Overflow leading to Frame Crash#158648
Copy link
Labels
pendingThe issue will be closed if no feedback is providedThe issue will be closed if no feedback is providedtype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

Description

@error-3317
error-3317
opened on Oct 3, 2026
Issue body actions

Bug report

Description

In Python/marshal.c, The TYPE_CODE reader accepts stacksize from untrusted marshal data with zero validation: stacksize = (int)r_long(p);

Objects/codeobject.c:550, When the code object is created, co_framesize is computed: co->co_framesize = nlocalsplus + con->stacksize + FRAME_SPECIALS_SIZE;

With stacksize = INT_MAX (2147483647) and nlocalsplus = 3, this overflows the signed 32-bit int and becomes -2147483642.

Objects/frameobject.c:2118, Frame allocation does the same overflow:

int slots = code->co_nlocalsplus + code->co_stacksize;
PyFrameObject *f = PyObject_GC_NewVar(PyFrameObject, &PyFrame_Type, slots);

Python/pystate.c:3136, The interpreter's frame push has a bug:

_PyInterpreterFrame *_PyThreadState_PushFrame(PyThreadState *tstate, size_t size) {
    assert(size < INT_MAX/sizeof(PyObject *));  // Compiled out with -DNDEBUG
    if (_PyThreadState_HasStackSpace(tstate, (int)size)) { 
        _PyInterpreterFrame *res = (_PyInterpreterFrame *)tstate->datastack_top;
        tstate->datastack_top += size;
        return res;
    }
  • This bug only occurs when using tracing, causing discrepancy in behavior.

PoC

# main.py
import marshal, struct, types

code = compile("def f(a, b, c): return a + b + c", "<t>", "exec")
ns = {}; 
exec(code, ns)
func_code = ns['f'].__code__

# Patch stacksize to INT_MAX in the marshal stream
data = bytearray(marshal.dumps(func_code))
data[13:17] = struct.pack('<i', 0x7fffffff)  # stacksize field

# Load it: no error, valid code object
evil = marshal.loads(bytes(data))
func = types.FunctionType(evil, globals())

print("Running func without tracing...")
print(func(1, 2, 3))

import sys
sys.settrace(lambda f, e, a: None)
print("Running func with tracing...")
func(1, 2, 3)

Output

Running func without tracing...
6
Running func with tracing...
Traceback (most recent call last):
  File "main.py", line 22, in <module>
    func(1, 2, 3)
    ~~~~^^^^^^^^^
SystemError: Missing frame when calling trace function.

CPython versions tested on:

3.15

Operating systems tested on:

Linux

Linked PRs

  • gh-158648: Reject code objects whose stacksize overflows co_framesize #159036

Activity

  1. error-3317
    added
    type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error
    on Oct 3, 2026
  2. picnixz commented on Oct 3, 2026

    @picnixz
    picnixz
    on Oct 3, 2026
    Member
    More actions

    I don't think this characterizes as a valid issue. Can it happen in practice? we don't accept such issues in genreal

    Reacted by Peter Bierma and Stan Ulbrych
  3. picnixz
    added
    pendingThe issue will be closed if no feedback is providedThe issue will be closed if no feedback is provided
    on Oct 3, 2026
  4. kevinprimeraquecreo-stack
    added this to Project_VKon Oct 18, 2026
  5. github-project-automation
    moved this to Todo in Project_VKon Oct 18, 2026
  6. github-project-automation
    moved this from Todo to In progress in Project_VKon Oct 18, 2026
  7. kevinprimeraquecreo-stack
    added this to Project_VKon Oct 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    pendingThe issue will be closed if no feedback is providedThe issue will be closed if no feedback is providedtype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      You are visitor 01402503 — GeezerVison does not store the pages you look up.
      Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.