Preventing the use of a null pointer in mro_hierarchy

[smurav]

In some cases type->tp_mro can be NULL and the new_mro variable can get a null value from the lookup_tp_mro call in the mro_hierarchy function.

cpython/Objects/typeobject.c

Line 1654 in 5f50541

PyObject *new_mro = lookup_tp_mro(type);

In this case, there may be problems with calling the Py_NewRef and the Py_DECREF functions.

cpython/Objects/typeobject.c

Line 1658 in 5f50541

tuple = PyTuple_Pack(3, type, new_mro, old_mro);

cpython/Objects/typeobject.c

Line 1661 in 5f50541

tuple = PyTuple_Pack(2, type, new_mro);

cpython/Objects/typeobject.c

Line 1674 in 5f50541

Py_DECREF(new_mro);

Linked PRs

• gh-132835: Fix using a null pointer in mro_hierarchy #132836
• gh-132835: Add defensive NULL checks in mro resolution #134763
• [3.14] gh-132835: Add defensive NULL checks to MRO resolution (GH-134763) #140436
• [3.13] gh-132835: Add defensive NULL checks to MRO resolution (GH-134763) #140437

[emmatyping]

@smurav based on your comment and looking over the code, I believe we can close this? Or do you have a case where there is a crash still?

[picnixz]

There are usages of lookup_tp_mro where we don't check for NULL a bit everywhere, but those usages are (afaict) after we checked that lookup_tp_mro doesn't return NULL (and in between nothing should have changed).

We could add assertions though and/or go through the occurrences of lookup_tp_mro to be sure that the result is correct (sometimes it's NULL and when it's NULL we set an exception and return).