From 2c2643912e5bcc5871c445b20c328fa68043ea20 Mon Sep 17 00:00:00 2001 From: Jelle Zijlstra Date: Tue, 20 Oct 2026 21:33:19 -0700 Subject: [PATCH] gh-159739: Keep generic alias arguments alive while formatting errors (GH-159981) When a generic alias contains a list of parameters and an object claiming to be an unpacked type-variable tuple returns a non-tuple from `__typing_subst__`, the error path frees the temporary argument tuple before reading it to format a `TypeError`. That use-after-free can crash the interpreter instead of reporting the invalid substitution. (cherry picked from commit 9c649dbaa80e905c9ccd874606cea706ca799a0d) Co-authored-by: Jelle Zijlstra --- .../2026-10-20-00-00-00.gh-issue-159739.a3cc5d.rst | 1 + Objects/genericaliasobject.c | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-10-20-00-00-00.gh-issue-159739.a3cc5d.rst diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-10-20-00-00-00.gh-issue-159739.a3cc5d.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-10-20-00-00-00.gh-issue-159739.a3cc5d.rst new file mode 100644 index 000000000000000..69c53e84e216b33 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-10-20-00-00-00.gh-issue-159739.a3cc5d.rst @@ -0,0 +1 @@ +Fix a crash when constructing an error for invalid generic alias arguments. diff --git a/Objects/genericaliasobject.c b/Objects/genericaliasobject.c index ddee7957178f48f..5649866cc502346 100644 --- a/Objects/genericaliasobject.c +++ b/Objects/genericaliasobject.c @@ -546,13 +546,13 @@ _Py_subs_parameters(PyObject *self, PyObject *args, PyObject *parameters, PyObje } if (unpack) { if (!PyTuple_Check(arg)) { - Py_DECREF(newargs); - Py_DECREF(item); - Py_XDECREF(tuple_args); PyObject *original = PyTuple_GET_ITEM(args, iarg); PyErr_Format(PyExc_TypeError, "expected __typing_subst__ of %T objects to return a tuple, not %T", original, arg); + Py_DECREF(newargs); + Py_DECREF(item); + Py_XDECREF(tuple_args); Py_DECREF(arg); return NULL; }