ctypes: crash when deleting Pointer.contents on the free-threaded build #156124
Copy link
Copy link
Closed
Labels
3.14bugs and security fixesbugs and security fixes3.15bugs and security fixesbugs and security fixes3.16new features, bugs and security fixesnew features, bugs and security fixesextension-modulesC modules in the Modules dirC modules in the Modules dirtopic-free-threadingtype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
Description
Crash report
del ptr.contents crashes the free-threaded build.
>>> from ctypes import POINTER, c_int
>>> ptr = POINTER(c_int)(c_int(42))
>>> del ptr.contents
Segmentation faultPointer_set_contents() passes the new value to Py_BEGIN_CRITICAL_SECTION2(), which dereferences it to get the mutex, but the value is NULL when the attribute is deleted. The check for NULL is in Pointer_set_contents_lock_held(), which is only called after the critical section is entered.
With the GIL it raises TypeError: Pointer does not support item deletion.
The critical section was added in gh-128182, so this affects 3.14 and newer.
Linked PRs
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
3.14bugs and security fixesbugs and security fixes3.15bugs and security fixesbugs and security fixes3.16new features, bugs and security fixesnew features, bugs and security fixesextension-modulesC modules in the Modules dirC modules in the Modules dirtopic-free-threadingtype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
Activity
gh-156124: Fix a crash when deleting ctypes Pointer.contents (GH-156125)
[3.14] gh-156124: Fix a crash when deleting ctypes Pointer.contents (G…
[3.15] gh-156124: Fix a crash when deleting ctypes Pointer.contents (G…