gh-144475: Fix a heap buffer overflow in partial_repr by bkap123 · Pull Request #144571 · python/cpython

bkap123 · 2026-02-07T16:19:16Z

Issue: heap-buffer-overflow in functools.partial.__repr__() #144475

python-cla-bot · 2026-02-07T16:19:21Z

The following commit authors need to sign the Contributor License Agreement:

bedevere-app · 2026-02-07T16:19:25Z

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

picnixz · 2026-02-07T17:57:22Z

Please:

add regression tests and check that the test failed before your change
remove blank lines in NEWS

Modules/_functoolsmodule.c

picnixz · 2026-02-07T18:00:33Z

By the way, @dr-carlos already suggested to open a PR. It is polite to ask them if they want to contribute themselves. As such, I'm going to close this one unless they are fine with you making the PR (we don't really want people "sniping" work of others)

bkap123 · 2026-02-07T18:39:35Z

Thanks for the feedback. I missed that @dr-carlos suggested to fix it.

I’m happy to close this PR if @dr-carlos is already working on it.

Co-authored-by: Bénédikt Tran <[email protected]>

dr-carlos · 2026-02-07T20:58:08Z

Thanks for the feedback. I missed that @dr-carlos suggested to fix it.

I’m happy to close this PR if @dr-carlos is already working on it.

Hi, thanks for asking!
I'm happy for you to continue with the PR :)

Modules/_functoolsmodule.c

bkap123 · 2026-02-08T01:11:33Z

Here are the changes I made:

I added a kw local pointer, as a similar segfault happens for keywords
I added an fn local pointer so that repr uses its original state when generating its final representation.
I got rid of the error goto and merged it with the done goto as I needed to decrement the reference count of fn, args, and kw, and I found that decrementing them in the done goto was the easiest.
Update: I changed the goto logic to reduce repetitive calls to Py_DECREF
I added a test based on @Qanux's original code in issue heap-buffer-overflow in functools.partial.__repr__() #144475. I extended it to also check for changes in the fn and kw arguments.

… Segment (pythonGH-145216) Remove the tp_clear slots and make Segment members read-only. Also add tests for reference loops involving GraphemeBreakIterator and Segment.

…ython#144831)

…zendict` (pythonGH-145249)

…g=False (python#144442)

…gh-145165)

…ython#144807)

…ythonGH-145250) It occurs in a code which perhaps never executed.

…44738) Closes python#123853

)

…ions (pythonGH-144824) Co-authored-by: Sergey Miryanov <[email protected]> Co-authored-by: Peter Bierma <[email protected]>

…gh-145157)

…thon#145304) Co-authored-by: Adam (indoor47) <[email protected]>

Co-authored-by: Hugo van Kemenade <[email protected]>

Remove PyThread_type_lock (now uses PyMutex internally). Add new benchmark options: - work_inside/work_outside: control work inside and outside the critical section to vary contention levels - num_locks: use multiple independent locks with threads assigned round-robin - total_iters: fixed iteration count per thread instead of time-based, useful for measuring fairness - num_acquisitions: lock acquisitions per loop iteration - random_locks: acquire random lock each iteration Also return elapsed time from benchmark_locks() and switch lockbench.py to use argparse.

… WASI builds (python#145328)

…h item (python#145282) Co-authored-by: Bartosz Sławecki <[email protected]>

Co-authored-by: Pieter Eendebak <[email protected]> --------- Co-authored-by: Pieter Eendebak <[email protected]>

Fix a heap buffer overflow in partial_repr

b0ffe74

bkap123 requested a review from rhettinger as a code owner February 7, 2026 16:19

bedevere-app bot added the awaiting review label Feb 7, 2026

bedevere-app bot mentioned this pull request Feb 7, 2026

heap-buffer-overflow in functools.partial.__repr__() #144475

Open

blurb-it bot and others added 3 commits February 7, 2026 16:37

📜🤖 Added by blurb_it.

7c1ed7e

Update 2026-02-07-16-37-42.gh-issue-144475.8tFEXw.rst

2723186

Update 2026-02-07-16-37-42.gh-issue-144475.8tFEXw.rst

239c40d

picnixz reviewed Feb 7, 2026

View reviewed changes

Modules/_functoolsmodule.c Outdated Show resolved Hide resolved

picnixz reviewed Feb 7, 2026

View reviewed changes

Modules/_functoolsmodule.c Outdated Show resolved Hide resolved

Apply suggestion from @picnixz

e53d7e9

Co-authored-by: Bénédikt Tran <[email protected]>

dr-carlos reviewed Feb 7, 2026

View reviewed changes

Modules/_functoolsmodule.c Outdated Show resolved Hide resolved

bkap123 and others added 3 commits February 7, 2026 16:39

Updates to partial_repr

661af78

Update 2026-02-07-16-37-42.gh-issue-144475.8tFEXw.rst

5ce61d9

Added test and fixed bug in functions/keword arguments

92eb6ea

bkap123 and others added 9 commits February 7, 2026 21:17

Update 2026-02-07-16-37-42.gh-issue-144475.8tFEXw.rst

5bf71f9

Update 2026-02-07-16-37-42.gh-issue-144475.8tFEXw.rst

cf63067

Merge branch 'main' into fix-functools_partial_repr_bug

838c8b1

improved goto logic

cb25ea5

Merge branch 'main' into fix-functools_partial_repr_bug

e18f2ad

Merge branch 'main' into fix-functools_partial_repr_bug

f1dc06f

Update 2026-02-07-16-37-42.gh-issue-144475.8tFEXw.rst

30d39f4

Update 2026-02-07-16-37-42.gh-issue-144475.8tFEXw.rst

a004007

Update 2026-02-07-16-37-42.gh-issue-144475.8tFEXw.rst

24307a2

serhiy-storchaka and others added 23 commits February 28, 2026 08:31

pythongh-145202: Fix crash in unicodedata's GraphemeBreakIterator and…

3032154

… Segment (pythonGH-145216) Remove the tp_clear slots and make Segment members read-only. Also add tests for reference loops involving GraphemeBreakIterator and Segment.

pythongh-106318: Add examples for str.rjust() method (python#143890)

7e3e3c7

pythongh-144190: Clarify get_type_hints() instance behavior in docs (p…

9577f19

…ython#144831)

pythongh-141510: Update PyDict_Copy documentation with note on `fro…

50beac6

…zendict` (pythonGH-145249)

pythongh-144316: Fix missing exception in _remote_debugging with debu…

b9b2499

…g=False (python#144442)

pythongh-141510: support frozendict's in the C decimal module (python…

0c4d940

…gh-145165)

pythongh-144872: fix heap buffer overflow _PyTokenizer_ensure_utf8 (p…

18910cc

…ython#144807)

pythongh-142787: Handle empty sqlite3 blob slices (python#142824)

26a469c

Fix unlikely potential reference leak in _locale._getdefaultlocale (p…

03ab030

…ythonGH-145250) It occurs in a code which perhaps never executed.

pythongh-123853: Cleanup Windows 95 locale fallback support (python#1…

6bedc25

…44738) Closes python#123853

pythongh-145234: Normalize decoded CR in string tokenizer (python#145281

aca1c73

)

pythongh-141004: Document missing type flags (pythonGH-145127)

2ccbe65

pythongh-144693: Clarify that PyFrame_GetBack does not raise except…

b1ae874

…ions (pythonGH-144824) Co-authored-by: Sergey Miryanov <[email protected]> Co-authored-by: Peter Bierma <[email protected]>

pythongh-145142: Make str.maketrans safe under free-threading (python…

bbcb932

…gh-145157)

pythongh-145305: Update ocert.org URLs in docs from http to https (py…

46a35ea

…thon#145304) Co-authored-by: Adam (indoor47) <[email protected]>

pythongh-76007: Deprecate tarfile.version (python#145326)

a1ecfd1

Co-authored-by: Hugo van Kemenade <[email protected]>

pythonGH-144533: Use wasmtime's --argv0 to auto-discover sysconfig in…

4560c85

… WASI builds (python#145328)

pythongh-145334: Make lazy import tests discoverable (python#145336)

2958b3c

pythongh-142927: Tachyon: Fix singular and plurals (python#145329)

e916488

pythongh-145241: specialize SyntaxError for single trailing-comma wit…

0d13a6e

…h item (python#145282) Co-authored-by: Bartosz Sławecki <[email protected]>

pythongh-145269: simplify bisect.bisect doc example (python#145270)

b17b37c

Co-authored-by: Pieter Eendebak <[email protected]> --------- Co-authored-by: Pieter Eendebak <[email protected]>

Add Stan to 'Dates and times' reviewers (python#145360)

8795fa5

bkap123 deleted the fix-functools_partial_repr_bug branch February 28, 2026 13:41

hugovk removed request for a team, berkerpeksag and freakboy3742 February 28, 2026 14:02

bkap123 mentioned this pull request Feb 28, 2026

gh-144475: Fix a heap buffer overflow in partial_repr #145362

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

gh-144475: Fix a heap buffer overflow in partial_repr#144571

gh-144475: Fix a heap buffer overflow in partial_repr#144571
bkap123 wants to merge 231 commits intopython:mainfrom
bkap123:fix-functools_partial_repr_bug

bkap123 commented Feb 7, 2026 •

edited by bedevere-app bot

Loading

Uh oh!

python-cla-bot bot commented Feb 7, 2026 •

edited

Loading

Uh oh!

bedevere-app bot commented Feb 7, 2026

Uh oh!

picnixz commented Feb 7, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

picnixz commented Feb 7, 2026 •

edited

Loading

Uh oh!

bkap123 commented Feb 7, 2026

Uh oh!

dr-carlos commented Feb 7, 2026

Uh oh!

Uh oh!

bkap123 commented Feb 8, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Uh oh!

Conversation

bkap123 commented Feb 7, 2026 • edited by bedevere-app bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

python-cla-bot bot commented Feb 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bedevere-app bot commented Feb 7, 2026

Uh oh!

picnixz commented Feb 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

picnixz commented Feb 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bkap123 commented Feb 7, 2026

Uh oh!

dr-carlos commented Feb 7, 2026

Uh oh!

Uh oh!

bkap123 commented Feb 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

bkap123 commented Feb 7, 2026 •

edited by bedevere-app bot

Loading

python-cla-bot bot commented Feb 7, 2026 •

edited

Loading

picnixz commented Feb 7, 2026 •

edited

Loading

picnixz commented Feb 7, 2026 •

edited

Loading

bkap123 commented Feb 8, 2026 •

edited

Loading