Description

JelleZijlstra

opened on Oct 19, 2026

Issue body actions

Bug report

I had a model look for security issues and it found a lot of things that are probably not exploitable but real edge-case C bugs. I'll open PRs for these (after manual review) and merge the fixes.

CPython versions tested on:

CPython main branch

Operating systems tested on:

macOS

Linked PRs

• gh-159739: Release SSL resources on error paths #159745
• gh-159739: Check character formatting allocation failure #159746
• gh-159739: Handle interpreter configuration encoding errors #159747
• gh-159739: Handle module filename encoding errors #159749
• gh-159739: Propagate macOS proxy conversion errors #159750
• gh-159739: Preserve the syntax error if metadata allocation fails #159751
• gh-159739: Release resources on interpreter startup error paths #159752
• gh-159739: Release tuple items if resizing fails #159754
• gh-159739: Preserve the normalization buffer on allocation failure #159755
• gh-159739: Fix reference and error handling in warnings #159758
• [3.15] gh-159739: Release SSL resources on error paths (GH-159745) #159761
• [3.14] gh-159739: Release SSL resources on error paths (GH-159745) #159762
• gh-159739: Preserve the full maxlen when copying deque subclasses #159765
• gh-159739: Read resized ctypes scalars using their declared size #159767
• gh-159739: Skip code-extra cleanup callbacks for NULL data #159768
• gh-159739: Release replaced PyInitConfig strings #159769
• gh-159739: [typing] Handle generic alias construction errors #159772
• gh-159739: Initialize template iterator references before allocating #159773
• gh-159739: Handle OrderedDict item iterator allocation failures #159774
• gh-159739: Handle overlapping buffers in BytesIO.readinto #159777
• gh-159739: Track group records for cyclic garbage collection #159778
• gh-159739: Reject the minimum dynamic formatting width #159780
• gh-159739: Avoid leaking references during free-threaded GC enumeration #159781
• gh-159739: Bound encoding-name lookahead in surrogatepass #159785
• [3.15] gh-159739: Release tuple items if resizing fails (GH-159754) #159787
• [3.14] gh-159739: Release tuple items if resizing fails (GH-159754) #159788
• [3.15] gh-159739: Release resources on interpreter startup error paths (GH-159752) #159793
• [3.14] gh-159739: Release resources on interpreter startup error paths (GH-159752) #159794
• gh-159739: Fix crash in _PyTuple_Resize() with an invalid size #159804
• [3.15] gh-159739: Release replaced PyInitConfig strings (GH-159769) #159809
• [3.14] gh-159739: Release replaced PyInitConfig strings (GH-159769) #159810
• [3.15] gh-159739: Check character formatting allocation failure (GH-159746) #159839
• [3.14] gh-159739: Check character formatting allocation failure (GH-159746) #159840
• [3.15] gh-159739: Handle module filename encoding errors (GH-159749) #159841
• [3.14] gh-159739: Handle module filename encoding errors (GH-159749) #159842
• [3.15] gh-159739: Handle interpreter configuration encoding errors (GH-159747) #159843
• [3.14] gh-159739: Handle interpreter configuration encoding errors (GH-159747) #159844
• [3.15] gh-159739: Preserve the syntax error if metadata allocation fails (GH-159751) #159845
• [3.14] gh-159739: Preserve the syntax error if metadata allocation fails (GH-159751) #159846
• [3.15] gh-159739: Preserve the full maxlen when copying deque subclasses (GH-159765) #159896
• [3.14] gh-159739: Preserve the full maxlen when copying deque subclasses (GH-159765) #159897
• [3.15] gh-159739: Read resized ctypes scalars using their declared size (GH-159767) #159898
• [3.14] gh-159739: Read resized ctypes scalars using their declared size (GH-159767) #159899
• [3.15] gh-159739: Initialize template iterator references before allocating (GH-159773) #159900
• [3.14] gh-159739: Initialize template iterator references before allocating (GH-159773) #159901
• [3.15] gh-159739: Handle overlapping buffers in BytesIO.readinto (GH-159777) #159902
• [3.14] gh-159739: Handle overlapping buffers in BytesIO.readinto (GH-159777) #159903
• [3.15] gh-159739: Track group records for cyclic garbage collection (GH-159778) #159904
• [3.14] gh-159739: Track group records for cyclic garbage collection (GH-159778) #159905
• [3.15] gh-159739: Reject the minimum dynamic formatting width (GH-159780) #159906
• [3.15] gh-159739: Avoid leaking references during free-threaded GC enumeration (GH-159781) #159907
• [3.14] gh-159739: Avoid leaking references during free-threaded GC enumeration (GH-159781) #159908
• [3.15] gh-159739: [typing] Handle generic alias construction errors (GH-159772) #159909
• [3.15] gh-159739: Bound encoding-name lookahead in surrogatepass (GH-159785) #159911
• [3.14] gh-159739: Bound encoding-name lookahead in surrogatepass (GH-159785) #159912
• [3.15] gh-159739: Handle OrderedDict item iterator allocation failures (GH-159774) #159915
• [3.14] gh-159739: [typing] Handle generic alias construction errors (GH-159772) #159929
• [3.14] gh-159739: Handle OrderedDict item iterator allocation failures (GH-159774) #159930
• [3.14] gh-159739: Reject the minimum dynamic formatting width (GH-159780) #159931
• [3.14] gh-159739: Propagate macOS proxy conversion errors (GH-159750) #159932
• [3.14] gh-159739: Preserve the normalization buffer on allocation failure (GH-159755) #159933
• [3.15] gh-159739: Propagate macOS proxy conversion errors (GH-159750) #159934
• [3.15] gh-159739: Preserve the normalization buffer on allocation failure (GH-159755) #159935
• gh-159739: Release weak proxy operands on errors #159968
• gh-159739: Respect readline limits after a short read #159974
• gh-159739: Collect grapheme iterator and segment type cycles #159975
• [3.15] gh-159739: Fix crash in _PyTuple_Resize() with an invalid size (GH-159804) #159976
• [3.14] gh-159739: Fix crash in _PyTuple_Resize() with an invalid size (GH-159804) #159977
• gh-159739: Break reference cycles involving property objects #159978
• gh-159739: Clear free-threaded GC worklists after early errors #159979
• gh-159739: Do not intern complex subclasses in code constants #159980
• gh-159739: Keep generic alias arguments alive while formatting errors #159981
• gh-159739: Avoid destroying a remote unwinder cache twice #159982
• gh-159739: Propagate fallback getaddrinfo allocation failures #159984
• gh-159739: Handle overlapping buffers in struct.pack_into #159985
• gh-159739: Preserve non-BMP characters in multibyte encoders #159987
• gh-159739: Avoid quadratic grouped-address parsing #159990
• gh-159739: Account for NUL terminators in fallback getnameinfo #159991
• [3.15] gh-159739: Collect grapheme iterator and segment type cycles (GH-159975) #160013
• [3.15] gh-159739: Break reference cycles involving property objects (GH-159978) #160014
• [3.14] gh-159739: Break reference cycles involving property objects (GH-159978) #160015
• [3.15] gh-159739: Clear free-threaded GC worklists after early errors (GH-159979) #160016
• [3.14] gh-159739: Clear free-threaded GC worklists after early errors (GH-159979) #160017
• [3.15] gh-159739: Release weak proxy operands on errors (GH-159968) #160018
• [3.14] gh-159739: Release weak proxy operands on errors (GH-159968) #160019
• [3.15] gh-159739: Keep generic alias arguments alive while formatting errors (GH-159981) #160020
• [3.14] gh-159739: Keep generic alias arguments alive while formatting errors (GH-159981) #160021
• [3.15] gh-159739: Fix reference and error handling in warnings (GH-159758) #160022
• [3.15] gh-159739: Avoid destroying a remote unwinder cache twice (GH-159982) #160023
• [3.14] gh-159739: Avoid destroying a remote unwinder cache twice (GH-159982) #160084
• [3.14] gh-159739: Fix reference and error handling in warnings (GH-159758) #160085
• [3.15] gh-159739: Account for NUL terminators in fallback getnameinfo (GH-159991) #160091
• [3.14] gh-159739: Account for NUL terminators in fallback getnameinfo (GH-159991) #160092
• [3.15] gh-159739: Preserve non-BMP characters in multibyte encoders (GH-159987) #160094
• [3.14] gh-159739: Preserve non-BMP characters in multibyte encoders (GH-159987) #160095
• [3.15] gh-159739: Propagate fallback getaddrinfo allocation failures (GH-159984) #160099
• [3.14] gh-159739: Propagate fallback getaddrinfo allocation failures (GH-159984) #160100
• [3.15] gh-159739: Handle overlapping buffers in struct.pack_into (GH-159985) #160101
• gh-159739: Skip context watchers cleared during notification #160164
• gh-159739: Keep SimpleQueue valid after buffer allocation fails #160165
• gh-159739: Allocate thread-local state before constructing the object #160166
• gh-159739: Release replaced type alias values #160167
• gh-159739: Hold the codec registry lock while unregistering #160168
• gh-159739: Fully clear the unpickler memo #160173
• gh-159739: Preserve ctypes base metadata when cloning fails #160174
• gh-159739: Preserve large years in time conversions #160175
• gh-159739: Handle overlapping mmap writes #160189
• gh-159739: Recheck BytesIO state after converting truncate size #160190
• gh-159739: Validate newline replacement in TextIOWrapper.write #160191
• gh-159739: Keep SQLite list parameters alive while binding #160192
• gh-159739: Keep descriptor metadata dictionaries alive during insertion #160193
• gh-159739: Detect recursive untyped ctypes arguments #160194
• gh-159739: Propagate float rounding allocation failures #160195
• gh-159739: Protect list storage while reporting its size #160196
• gh-159739: Preserve ContextVar cache updates from finalizers #160197
• gh-159739: Keep the instance type alive during ABC subclass checks #160198
• [3.15] gh-159739: Release replaced type alias values (GH-160167) #160242
• [3.14] gh-159739: Release replaced type alias values (GH-160167) #160243
• [3.15] gh-159739: Respect readline limits after a short read (GH-159974) #160246
• [3.15] gh-159739: Do not intern complex subclasses in code constants (GH-159980) #160249
• [3.14] gh-159739: Do not intern complex subclasses in code constants (GH-159980) #160250
• [3.14] gh-159739: Allocate thread-local state before constructing the object (GH-160166) #160285
• [3.15] gh-159739: Allocate thread-local state before constructing the object (GH-160166) #160286
• [3.14] gh-159739: Keep SimpleQueue valid after buffer allocation fails (GH-160165) #160287
• [3.15] gh-159739: Keep SimpleQueue valid after buffer allocation fails (GH-160165) #160288
• [3.14] gh-159739: Skip context watchers cleared during notification (GH-160164) #160289
• [3.15] gh-159739: Skip context watchers cleared during notification (GH-160164) #160291
• [3.15] gh-159739: Hold the codec registry lock while unregistering (GH-160168) #160292
• [3.15] gh-159739: Preserve ctypes base metadata when cloning fails (GH-160174) #160293
• [3.14] gh-159739: Preserve ctypes base metadata when cloning fails (GH-160174) #160294
• [3.15] gh-159739: Fully clear the unpickler memo (GH-160173) #160328
• [3.14] gh-159739: Preserve ContextVar cache updates from finalizers (GH-160197) #160329
• [3.15] gh-159739: Preserve ContextVar cache updates from finalizers (GH-160197) #160330
• [3.15] gh-159739: Detect recursive untyped ctypes arguments (GH-160194) #160350
• [3.14] gh-159739: Detect recursive untyped ctypes arguments (GH-160194) #160351
• [3.15] gh-159739: Keep SQLite list parameters alive while binding (GH-160192) #160361
• [3.14] gh-159739: Keep SQLite list parameters alive while binding (GH-160192) #160362
• [3.15] gh-159739: Protect list storage while reporting its size (GH-160196) #160363
• [3.14] gh-159739: Protect list storage while reporting its size (GH-160196) #160364
• [3.15] gh-159739: Keep descriptor metadata dictionaries alive during insertion (GH-160193) #160382
• [3.14] gh-159739: Keep descriptor metadata dictionaries alive during insertion (GH-160193) #160383
• [3.15] gh-159739: Recheck BytesIO state after converting truncate size (GH-160190) #160384
• [3.14] gh-159739: Recheck BytesIO state after converting truncate size (GH-160190) #160385
• gh-159739: Keep text I/O state valid across reentrant callbacks #160398
• gh-159739: Handle pyexpat configuration changes during callbacks #160399
• gh-159739: Preserve CJK codec state across chunk boundaries and callbacks #160400
• gh-159739: Keep sqlite3 cursor metadata and factories valid during queries #160403
• gh-159739: Guard cProfile against reentry while processing an external timer #160405
• [3.14] gh-159739: Handle pyexpat configuration changes during callbacks (GH-160399) #160474
• [3.15] gh-159739: Handle pyexpat configuration changes during callbacks (GH-160399) #160475
• [3.14] gh-159739: Respect readline limits after a short read (GH-159974) #160483
• [3.14] gh-159739: Handle overlapping buffers in struct.pack_into (GH-159985) #160484
• [3.14] gh-159739: Hold the codec registry lock while unregistering (GH-160168) #160485
• [3.14] gh-159739: Fully clear the unpickler memo (GH-160173) #160486
• [3.14] gh-159739: Validate newline replacement in TextIOWrapper.write (GH-160191) #160487
• [3.14] gh-159739: Keep the instance type alive during ABC subclass checks (GH-160198) #160488
• [3.15] gh-159739: Keep the instance type alive during ABC subclass checks (GH-160198) #160489
• [3.15] gh-159739: Guard cProfile against reentry while processing an external timer (GH-160405) #160566
• [3.14] gh-159739: Guard cProfile against reentry while processing an external timer (GH-160405) #160567
• [3.15] gh-159739: Keep text I/O state valid across reentrant callbacks (GH-160398) #160623
• [3.15] gh-159739: Preserve CJK codec state across chunk boundaries and callbacks (GH-160400) #161069
• [3.14] gh-159739: Preserve CJK codec state across chunk boundaries and callbacks (GH-160400) #161070
• gh-159739: Merge the duplicate NEWS entries for the hz tilde fix #161085
• [3.15] gh-159739: Merge the duplicate NEWS entries for the hz tilde fix (GH-161085) #161141
• [3.14] gh-159739: Merge the duplicate NEWS entries for the hz tilde fix (GH-161085) #161142
• [3.14] gh-159739: Preserve large years in time conversions (GH-160175) #161648
• [3.15] gh-159739: Preserve large years in time conversions (GH-160175) #161649

Reacted by Neko Asakura, Gregory P. Smith, Donghee Na and Kirill Podoprigora

Activity

1. JelleZijlstra

   self-assigned this

   on Oct 19, 2026
2. JelleZijlstra

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Oct 19, 2026
3. picnixz

   added

   interpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)

   extension-modulesC modules in the Modules dirC modules in the Modules dir

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   and removed

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   interpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)

   extension-modulesC modules in the Modules dirC modules in the Modules dir

   on Oct 19, 2026
4. gpshead

   added 5 commits that reference this issue on Oct 19, 2026

   pythongh-159739: Release tuple items if resizing fails

   663ceaf

   pythongh-159739: Add a regression test for the _PyTuple_Resize() leak

   dccd34e

   pythongh-159739: Fix crash in _PyTuple_Resize() with an invalid size

   be67b56

   gh-159739: Release SSL resources on error paths (GH-159745)

   b2b0a33

   gh-159739: Release tuple items if resizing fails (GH-159754)

   14cd72b
5. 171 remaining items

   Load more actions
6. JelleZijlstra

   added 3 commits that reference this issue on Oct 24, 2026

   [3.15] gh-159739: Keep the instance type alive during ABC subclass ch…

   e736c96

   gh-159739: Keep text I/O state valid across reentrant callbacks (#160398

   665bda9

   gh-159739: Keep sqlite3 cursor metadata and factories valid during qu…

   656af53
7. gpshead

   added 5 commits that reference this issue on Nov 1, 2026

   [3.14] gh-159739: Preserve CJK codec state across chunk boundaries an…

   d67f2a9

   [3.15] gh-159739: Preserve CJK codec state across chunk boundaries an…

   06367c6

   gh-159739: Merge the duplicate NEWS entries for the hz tilde fix (GH-…

   b71fadc

   [3.15] gh-159739: Merge the duplicate NEWS entries for the hz tilde f…

   9b917b1

   [3.14] gh-159739: Merge the duplicate NEWS entries for the hz tilde f…

   98a26e9
8. JelleZijlstra

   added a commit that references this issue on Nov 2, 2026

   [3.15] gh-159739: Keep text I/O state valid across reentrant callbacks (

   0262ca1
9. ZeroIntensity

   added a commit that references this issue on Nov 4, 2026

   gh-160708: Use the type size for resized ctypes simple objects (GH-16…

   44579b0
10. gpshead

    added 2 commits that reference this issue on Nov 9, 2026

    [3.14] gh-159739: Handle overlapping buffers in struct.pack_into (GH-…

    a96096c

    gh-159739: Preserve large years in time conversions (GH-160175)

    e1a4c15
11. cobed95

    added 2 commits that reference this issue on Nov 10, 2026

    Merge branch 'main' into pythongh-155619

    54350da

    Serialize context watcher add and clear

    56c8877
12. ZeroIntensity

    added a commit that references this issue on Nov 11, 2026

    [3.15] gh-160708: Use the type size for resized ctypes simple objects (…

    f539f34

Issue actions