Skip to content

Use after free (stackref borrow after close) in BINARY_OP_INPLACE_ADD_UNICODE #130786

Closed

Description

@markshannon

Crash report

What happened?

Using the Py_STACKREF_CLOSE_DEBUG option adding in #130785, we can detect a use-after-free in BINARY_OP_INPLACE_ADD_UNICODE:

 Fatal Python error: _Py_stackref_record_borrow: 
   Borrow of closed ref ID 15609203 at Python/generated_cases.c.h:59.
   Referred to instance of str at 0x55a2b6c5ff10. 
   Closed at Python/generated_cases.c.h:344

The problem is that the stack ref is closed before we deopt on line 736.

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Output from running 'python -VV' on the command line:

No response

Activity

  1. added
    type-crashA hard crash of the interpreter, possibly with a core dump
    on Mar 3, 2025
  2. efimov-mikhail commented on Sep 29, 2025

    @efimov-mikhail
    Member

    It seems that this issue should be closed, since #130708 was merged.

  3. added
    pendingThe issue will be closed if no feedback is provided
    on Oct 4, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    interpreter-core(Objects, Python, Grammar, and Parser dirs)pendingThe issue will be closed if no feedback is providedtype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions