-
-
Notifications
You must be signed in to change notification settings - Fork 34.4k
Flawed assumptions about tp_dictoffset in inheritance. #95589
Copy link
Copy link
Closed
Labels
3.10only security fixesonly security fixes3.11only security fixesonly security fixes3.12only security fixesonly security fixes3.9 (EOL)end of lifeend of lifetype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or errortype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
Metadata
Metadata
Assignees
Labels
3.10only security fixesonly security fixes3.11only security fixesonly security fixes3.12only security fixesonly security fixes3.9 (EOL)end of lifeend of lifetype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or errortype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
In Python, the
__dict__and__weakref__slots are treated specially (slots meaning__slots__, nottp_slots)They are automatically insert by the VM when creating a class.
In order to support inheritance, specifically multiple inheritance, the VM can lay out subclasses in ways that differ from the superclass.
This is OK, provided
__dict__and__weakref__are only accessed though thetp_dictoffsetandtp_weaklistoffsetoffsets.But, if either field is accessed directly, then we access invalid memory and 💥
test.py:
$ python3.10 ~/test/test.py Segmentation fault (core dumped)We have (accidentally) fixed this for
__dict__in 3.11, although at the expense breaking backwards compatibility for some C extensions. However, the problem still remains for__weakref__.Backwards incompatibility