`_remote_debugging`: `BinaryWriter.write_sample()` trivial segfault · Issue #157227 · python/cpython · GitHub

Bug report

Bug description:

[139] 2026-09-09T18:57:09.249268000+0200 maurycy@gimel /Users/maurycy/work/cpython (main 52ffffe) % ./python.exe 
Python 3.16.0a0 (heads/main:83dbe6ae9f4, Sep  6 2026, 18:18:16) [Clang 21.0.0 (clang-2100.1.1.101)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import _remote_debugging
>>> _remote_debugging.BinaryWriter("/tmp/o.bin", 1000, 1000000).write_sample([42], 2000)
zsh: segmentation fault  ./python.exe

There's many more variants, easy to come up with.

This is the place:

cpython/Modules/_remote_debugging/binary_io_writer.c

Line 1013 in 52ffffe

if (!PyList_Check(stack_frames)) {

It only checks if it's a list, and then it trusts completely:

cpython/Modules/_remote_debugging/binary_io_writer.c

Lines 841 to 848 in 52ffffe

    
           /* Use unchecked accessors since we control the data structures */ 
        
           PyObject *frame_info = PyList_GET_ITEM(frame_list, k); 
        
           /* Get filename, location, funcname, opcode from FrameInfo using unchecked access */ 
        
           PyObject *filename = PyStructSequence_GET_ITEM(frame_info, 0); 
        
           PyObject *location = PyStructSequence_GET_ITEM(frame_info, 1); 
        
           PyObject *funcname = PyStructSequence_GET_ITEM(frame_info, 2); 
        
           PyObject *opcode_obj = PyStructSequence_GET_ITEM(frame_info, 3);

cpython/Modules/_remote_debugging/binary_io_writer.c

Lines 928 to 930 in 52ffffe

    
           PyObject *thread_id_obj = PyStructSequence_GET_ITEM(thread_info, 0); 
        
           PyObject *status_obj = PyStructSequence_GET_ITEM(thread_info, 1); 
        
           PyObject *frame_list = PyStructSequence_GET_ITEM(thread_info, 2);

cpython/Modules/_remote_debugging/binary_io_writer.c

Lines 1020 to 1023 in 52ffffe

    
           PyObject *interp_info = PyList_GET_ITEM(stack_frames, i); 
        
           PyObject *interp_id_obj = PyStructSequence_GET_ITEM(interp_info, 0); 
        
           PyObject *threads = PyStructSequence_GET_ITEM(interp_info, 1);

The comment says Use unchecked accessors since we control the data structures but I still think that segmentation fault on a public method is not great.

I will submit a PR soon.

ref #148178

CPython versions tested on:

CPython main branch

Operating systems tested on:

macOS

Linked PRs

gh-157227: _remote_debugging: Validate lists and tuples in write_sample #157228

`_remote_debugging`: `BinaryWriter.write_sample()` trivial segfault · Issue #157227 · python/cpython · GitHub

Repository navigation

_remote_debugging: BinaryWriter.write_sample() trivial segfault #157227

Bug report

Bug description:

CPython versions tested on:

Operating systems tested on:

Linked PRs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

	/* Use unchecked accessors since we control the data structures */
	PyObject *frame_info = PyList_GET_ITEM(frame_list, k);

	/* Get filename, location, funcname, opcode from FrameInfo using unchecked access */
	PyObject *filename = PyStructSequence_GET_ITEM(frame_info, 0);
	PyObject *location = PyStructSequence_GET_ITEM(frame_info, 1);
	PyObject *funcname = PyStructSequence_GET_ITEM(frame_info, 2);
	PyObject *opcode_obj = PyStructSequence_GET_ITEM(frame_info, 3);

	PyObject *thread_id_obj = PyStructSequence_GET_ITEM(thread_info, 0);
	PyObject *status_obj = PyStructSequence_GET_ITEM(thread_info, 1);
	PyObject *frame_list = PyStructSequence_GET_ITEM(thread_info, 2);

	PyObject *interp_info = PyList_GET_ITEM(stack_frames, i);

	PyObject *interp_id_obj = PyStructSequence_GET_ITEM(interp_info, 0);
	PyObject *threads = PyStructSequence_GET_ITEM(interp_info, 1);

`_remote_debugging`: `BinaryWriter.write_sample()` trivial segfault · Issue #157227 · python/cpython · GitHub

Repository navigation

_remote_debugging: BinaryWriter.write_sample() trivial segfault #157227

Description

Bug report

Bug description:

CPython versions tested on:

Operating systems tested on:

Linked PRs

Activity

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions