create_builtin() in _imp module trigger segfault if taking a builtin object as input

[xiaxinmeng]

Crash report

In the following test program, _imp.create_builtin takes a object A as input. The object instance the name attribute as "self" at "self.name = self". This action triggers a segfault on CPython 3.10.7 and CPython 3.10.7. Similarly, if self.name = other keywords, e.g.,int, print, the program also crashes. It may need a checker for _imp.create_builtin to avoid keywords.

import _imp

class FakeSpec:
	def __init__(self, name):
		self.name = self

A = FakeSpec("time")

imp_time = _imp.create_builtin(A)

Error messages

Expected behavior on CPython 3.9.0

Traceback (most recent call last):
  File "/home/xxm/Desktop/imp.py", line 9, in <module>
    imp_time = _imp.create_builtin(A)
TypeError: bad argument type for built-in operation

Unexpected Behavior on CPython 3.10.8
Segmentation fault(core dumped)

Your environment

• CPython versions tested on:Python 3.10.8, Python 3.10.7

• Operating system and architecture: [GCC 7.5.0] on linux

[chgnrdv]

Crashes on 3.12.0a0 with the following message:

Objects/unicodeobject.c:498: _PyUnicode_CheckConsistency: Assertion failed: PyType_HasFeature((Py_TYPE(((PyObject*)((op))))), ((1UL << 28)))
Enable tracemalloc to get the memory block allocation traceback

object address  : 0x7ffff77eb530
object refcount : 4
object type     : 0x555555c2b9b0
object type name: FakeSpec
object repr     : <__main__.FakeSpec object at 0x7ffff77eb530>

Fatal Python error: _PyObject_AssertFailed: _PyObject_AssertFailed
Python runtime state: initialized

Current thread 0x00007ffff7cad740 (most recent call first):
  File "/home/.../cpython/crash_98354.py", line 9 in <module>

Program received signal SIGABRT, Aborted.

Looks like _imp_create_builtin should check name for being a str instance in general, not only to avoid it being a keyword.

[ericsnowcurrently]

To be clear, code should not be using the _imp module directly. That said, this would be relatively easy to reproduce with a metapath finder.

Regardless, I was able to reproduce this on main (3.12, c051d55) using the OP code. It is not crashing on 3.8 (but does fail with a TypeError). Likewise with 3.9.

It does start crashing in 3.10. Looks like it started in 6223071 (GH-23378). It was probably caught before by the PyUnicode_AsUTF8() (which was removed). Checking for PyUnicode should restore the pre-3.10 behavior.

[ericsnowcurrently]

Per #98412 (comment), this might not be completely fixed yet.

@xiaxinmeng, can you verify if the problem you had is fixed on the main branch (i.e. 3.12a1)?

[ericsnowcurrently]

Additional info from @chgnrdv:

• gh-98354: Add unicode check for 'name' attribute in _imp_create_builtin #98412 (comment)
• gh-98354: Add unicode check for 'name' attribute in _imp_create_builtin #98412 (comment)

@chgnrdv, can you confirm this is fixed by gh-99642 (for gh-99578)? If so, we can close this issue.

[xiaxinmeng]

Per #98412 (comment), this might not be completely fixed yet.

@xiaxinmeng, can you verify if the problem you had is fixed on the main branch (i.e. 3.12a1)?

Sorry for being late @ericsnowcurrently . I think this problem has been fixed.
It does not crash CPython any more, the behavior on the main branch 8f18ac0 is as follows:

Traceback (most recent call last):
  File "/home/xxm/Downloads/cpython-main(2)/test.py", line 9, in <module>
    imp_time = _imp.create_builtin(A)
               ^^^^^^^^^^^^^^^^^^^^^^
TypeError: name must be string, not FakeSpec

[chgnrdv]

@ericsnowcurrently, sorry for the slow response. Yes, I confirm that refleak issue is fixed by gh-99578, and therefore we can close this one.