Skip to content

gh-146065: Fix NULL dereference in FutureIter_am_send#146304

Open
VanshAgarwal24036 wants to merge 6 commits intopython:mainfrom
VanshAgarwal24036:gh-146065-fix-futureiter-null-deref
Open

gh-146065: Fix NULL dereference in FutureIter_am_send#146304
VanshAgarwal24036 wants to merge 6 commits intopython:mainfrom
VanshAgarwal24036:gh-146065-fix-futureiter-null-deref

Conversation

@VanshAgarwal24036
Copy link
Contributor

@VanshAgarwal24036 VanshAgarwal24036 commented Mar 22, 2026 •
edited by bedevere-app bot
Loading

After throw() or close(), it->future can be NULL. A subsequent send() call would dereference it and crash. This adds a NULL check and raises StopIteration instead.

@bedevere-app bedevere-app bot mentioned this pull request Mar 22, 2026
Open
picnixz
picnixz reviewed Mar 22, 2026
View reviewed changes
picnixz
picnixz requested changes Mar 22, 2026
View reviewed changes
@bedevere-app
Copy link

bedevere-app bot commented Mar 22, 2026

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

@VanshAgarwal24036
Copy link
Contributor Author

VanshAgarwal24036 commented Mar 22, 2026

I have made the requested changes; please review again

@bedevere-app
Copy link

bedevere-app bot commented Mar 22, 2026

Thanks for making the requested changes!

@picnixz: please review the changes made to this pull request.

@bedevere-app bedevere-app bot requested a review from picnixz March 22, 2026 19:04
@JesusAnaya
Copy link

JesusAnaya commented Mar 24, 2026 •
edited
Loading

I was able to reproduce and verify this fix locally on macOS (x86_64).

Without the fix (NULL check in FutureIter_am_send removed): test_futureiter_send_after_throw_no_crash crashes with a segfault, confirmed NULL dereference in FutureIter_am_send when it->future is NULL after a prior throw().

With the fix (NULL check restored): all three variants of the test pass (CFutureTests, CSubFutureTests, PyFutureTests), and the full test.test_asyncio.test_futures suite passes (186/186 tests OK, no regressions).

vstinner
vstinner approved these changes Mar 25, 2026
View reviewed changes
Copy link
Member

@vstinner vstinner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

I confirm that test_futureiter_send_after_throw_no_crash() does crash without the fix, and pass with the fix.

@kumaraditya303: Do you want to double check this fix? I didn't work on ayncio recently, and I'm not 100% sure if raising StopIteration is the correct behavior in this case.

@VanshAgarwal24036 @vstinner
Update Misc/NEWS.d/next/Library/2026-03-23-00-04-13.gh-issue-146065.F…
dafe523 
…Idn8D.rst

Co-authored-by: Victor Stinner <vstinner@python.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vstinner vstinner vstinner approved these changes

@1st1 1st1 Awaiting requested review from 1st1 1st1 is a code owner

@asvetlov asvetlov Awaiting requested review from asvetlov asvetlov is a code owner

@kumaraditya303 kumaraditya303 Awaiting requested review from kumaraditya303 kumaraditya303 is a code owner

@willingc willingc Awaiting requested review from willingc willingc is a code owner

@picnixz picnixz Awaiting requested review from picnixz

Assignees

No one assigned

Labels

awaiting merge

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@VanshAgarwal24036 @JesusAnaya @vstinner @picnixz