From ec9abd661618617264c1c7d5e1a23badf26ca4d6 Mon Sep 17 00:00:00 2001 From: "Gregory P. Smith" Date: Mon, 19 Oct 2026 22:38:20 +0000 Subject: [PATCH 1/3] gh-159739: Add a regression test for the _PyTuple_Resize() leak Check that the items of a non-empty tuple are released when the reallocation in _PyTuple_Resize() fails. --- Lib/test/test_capi/test_tuple.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/Lib/test/test_capi/test_tuple.py b/Lib/test/test_capi/test_tuple.py index d497ba30b001ac..c6dde0f50640df 100644 --- a/Lib/test/test_capi/test_tuple.py +++ b/Lib/test/test_capi/test_tuple.py @@ -327,6 +327,15 @@ def test__tuple_resize(self): self.assertRaises(MemoryError, resize, a, PY_SSIZE_T_MAX) self.assertRaises(SystemError, resize, a, -1) self.assertRaises(SystemError, resize, a, PY_SSIZE_T_MIN) + # gh-159739: items are released if the reallocation fails + x = object() + refcnt = getrefcount(x) + a = (x, x, x) + # Too large to allocate, but small enough not to overflow. + newsize = PY_SSIZE_T_MAX // _testcapi.SIZEOF_VOID_P - 100 + self.assertRaises(MemoryError, resize, a, newsize) + del a + self.assertEqual(getrefcount(x), refcnt) # refcount > 1 a = (1, 2, 3) self.assertRaises(SystemError, resize, a, 3, False) From db04f577c655c12730cb7fccddc3da0a1dc8e549 Mon Sep 17 00:00:00 2001 From: "Gregory P. Smith" Date: Mon, 19 Oct 2026 22:38:39 +0000 Subject: [PATCH 2/3] gh-159739: Fix crash in _PyTuple_Resize() with an invalid size _PyTuple_Resize() did not validate newsize for non-empty tuples. Raise SystemError for a negative size and MemoryError for a too-large size, like PyTuple_New() already does for the empty-tuple path. --- Lib/test/test_capi/test_tuple.py | 4 ++++ .../2026-10-19-21-05-12.gh-issue-159739.Rk3fTq.rst | 3 +++ Objects/tupleobject.c | 10 +++++++++- 3 files changed, 16 insertions(+), 1 deletion(-) create mode 100644 Misc/NEWS.d/next/C_API/2026-10-19-21-05-12.gh-issue-159739.Rk3fTq.rst diff --git a/Lib/test/test_capi/test_tuple.py b/Lib/test/test_capi/test_tuple.py index c6dde0f50640df..0215c7a12ca788 100644 --- a/Lib/test/test_capi/test_tuple.py +++ b/Lib/test/test_capi/test_tuple.py @@ -327,6 +327,10 @@ def test__tuple_resize(self): self.assertRaises(MemoryError, resize, a, PY_SSIZE_T_MAX) self.assertRaises(SystemError, resize, a, -1) self.assertRaises(SystemError, resize, a, PY_SSIZE_T_MIN) + a = ([1], [2], [3]) + self.assertRaises(MemoryError, resize, a, PY_SSIZE_T_MAX) + self.assertRaises(SystemError, resize, a, -1) + self.assertRaises(SystemError, resize, a, PY_SSIZE_T_MIN) # gh-159739: items are released if the reallocation fails x = object() refcnt = getrefcount(x) diff --git a/Misc/NEWS.d/next/C_API/2026-10-19-21-05-12.gh-issue-159739.Rk3fTq.rst b/Misc/NEWS.d/next/C_API/2026-10-19-21-05-12.gh-issue-159739.Rk3fTq.rst new file mode 100644 index 00000000000000..2d510c63ac07a8 --- /dev/null +++ b/Misc/NEWS.d/next/C_API/2026-10-19-21-05-12.gh-issue-159739.Rk3fTq.rst @@ -0,0 +1,3 @@ +Fix a crash in :c:func:`_PyTuple_Resize` when resizing a non-empty tuple to a +negative or too large size. It now raises :exc:`SystemError` or +:exc:`MemoryError` respectively. diff --git a/Objects/tupleobject.c b/Objects/tupleobject.c index d7523e31779971..1ca28379f328cf 100644 --- a/Objects/tupleobject.c +++ b/Objects/tupleobject.c @@ -1021,7 +1021,7 @@ _PyTuple_Resize(PyObject **pv, Py_ssize_t newsize) Py_ssize_t oldsize; v = (PyTupleObject *) *pv; - if (v == NULL || !Py_IS_TYPE(v, &PyTuple_Type) || + if (v == NULL || !Py_IS_TYPE(v, &PyTuple_Type) || newsize < 0 || (Py_SIZE(v) != 0 && !_PyObject_IsUniquelyReferenced(*pv))) { *pv = 0; Py_XDECREF(v); @@ -1048,6 +1048,14 @@ _PyTuple_Resize(PyObject **pv, Py_ssize_t newsize) *pv = PyTuple_New(newsize); return *pv == NULL ? -1 : 0; } + /* Check for overflow */ + if ((size_t)newsize > ((size_t)PY_SSIZE_T_MAX - (sizeof(PyTupleObject) - + sizeof(PyObject *))) / sizeof(PyObject *)) { + *pv = NULL; + Py_DECREF(v); + PyErr_NoMemory(); + return -1; + } if (_PyObject_GC_IS_TRACKED(v)) { _PyObject_GC_UNTRACK(v); From ff99345a2131e8580d432a8abfe20d45c69fa039 Mon Sep 17 00:00:00 2001 From: "Gregory P. Smith" Date: Tue, 20 Oct 2026 19:51:41 +0000 Subject: [PATCH 3/3] gh-159739: Remove the realloc failure test from test__tuple_resize It relied on a huge allocation request failing, which is not portable: TSan aborts on it and it succeeds on wasm32 (WASI). --- Lib/test/test_capi/test_tuple.py | 9 --------- 1 file changed, 9 deletions(-) diff --git a/Lib/test/test_capi/test_tuple.py b/Lib/test/test_capi/test_tuple.py index 0215c7a12ca788..fe5d694ea7d831 100644 --- a/Lib/test/test_capi/test_tuple.py +++ b/Lib/test/test_capi/test_tuple.py @@ -331,15 +331,6 @@ def test__tuple_resize(self): self.assertRaises(MemoryError, resize, a, PY_SSIZE_T_MAX) self.assertRaises(SystemError, resize, a, -1) self.assertRaises(SystemError, resize, a, PY_SSIZE_T_MIN) - # gh-159739: items are released if the reallocation fails - x = object() - refcnt = getrefcount(x) - a = (x, x, x) - # Too large to allocate, but small enough not to overflow. - newsize = PY_SSIZE_T_MAX // _testcapi.SIZEOF_VOID_P - 100 - self.assertRaises(MemoryError, resize, a, newsize) - del a - self.assertEqual(getrefcount(x), refcnt) # refcount > 1 a = (1, 2, 3) self.assertRaises(SystemError, resize, a, 3, False)