Crash with an evil custom mro() on a metaclass · Issue #92112 · python/cpython (original) (raw)

Skip to content

Navigation Menu

• • GitHub Copilot Write better code with AI
  • GitHub Advanced Security Find and fix vulnerabilities
  • Actions Automate any workflow
  • Codespaces Instant dev environments
  • Issues Plan and track work
  • Code Review Manage code changes
  • Discussions Collaborate outside of code
  • Code Search Find more, search less
• Explore
  • Learning Pathways
  • Events & Webinars
  • Ebooks & Whitepapers
  • Customer Stories
  • Partners
  • Executive Insights
• • GitHub Sponsors Fund open source developers
  • The ReadME Project GitHub community articles
• • Enterprise platform AI-powered developer platform
• Pricing

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sign up

Appearance settings

Description

Crash report

There is a path in type_mro_modified that results in double-free of *mro_meth:

A reproducer:

class B:
    pass

class M(type):
    def mro(cls):
        del M.mro
        return (B,)

class C(metaclass=M):
    pass

Crash with the debug CPython:

$ ./python mro-crasher.py
/home/test/cpython/Include/object.h:601: _Py_NegativeRefcount: Assertion failed: object has negative ref count
<object at 0x7f88c12d1a90 is freed>
Fatal Python error: _PyObject_AssertFailed: _PyObject_AssertFailed
Python runtime state: initialized

Current thread 0x00007f88c13cb080 (most recent call first):
  File "/home/test/mro-crasher.py", line 9 in <module>
Aborted (core dumped)

This bug was introduced in #73052.