From cb16046654db85a11f765d1f8ad802bdf895654f Mon Sep 17 00:00:00 2001 From: Santhosh-I Date: Mon, 22 Jun 2026 15:26:31 +0530 Subject: [PATCH 1/4] Fix segfault in type() with NULL tp_new metaclasses --- Objects/typeobject.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Objects/typeobject.c b/Objects/typeobject.c index 59593fd0f6a0b7..7848f1c1760711 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -5031,6 +5031,13 @@ type_new_get_bases(type_new_ctx *ctx, PyObject **type) if (winner != ctx->metatype) { if (winner->tp_new != type_new) { + /* Check if tp_new is NULL (cannot instantiate this type) */ + if (winner->tp_new == NULL) { + PyErr_Format(PyExc_TypeError, + "cannot create '%.400s' instances", + winner->tp_name); + return -1; + } /* Pass it to the winner */ *type = winner->tp_new(winner, ctx->args, ctx->kwds); if (*type == NULL) { From 7d1432e3c5ed2aa37454b63687405ed61b2b84a7 Mon Sep 17 00:00:00 2001 From: "blurb-it[bot]" <43283697+blurb-it[bot]@users.noreply.github.com> Date: Mon, 22 Jun 2026 14:48:24 +0000 Subject: [PATCH 2/4] =?UTF-8?q?=F0=9F=93=9C=F0=9F=A4=96=20Added=20by=20blu?= =?UTF-8?q?rb=5Fit.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst | 1 + 1 file changed, 1 insertion(+) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst new file mode 100644 index 00000000000000..f0b7b860e76b29 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst @@ -0,0 +1 @@ +Fixed a crash in `type()` when selecting a metaclass whose `tp_new` slot is `NULL`. Such metaclasses are now rejected with `TypeError` instead of causing a NULL pointer dereference. From 3e9e1642b525e10dc5194ebc6351bc592af7ec45 Mon Sep 17 00:00:00 2001 From: Santhosh-I Date: Tue, 23 Jun 2026 13:58:14 +0530 Subject: [PATCH 3/4] Fix formatting in NEWS entry for type() crash fix --- .../2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst index f0b7b860e76b29..07b73949b438a3 100644 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst @@ -1 +1 @@ -Fixed a crash in `type()` when selecting a metaclass whose `tp_new` slot is `NULL`. Such metaclasses are now rejected with `TypeError` instead of causing a NULL pointer dereference. +Fixed a crash in ``type()`` when selecting a metaclass whose ``tp_new`` slot is ``NULL``. Such metaclasses are now rejected with ``TypeError`` instead of causing a NULL pointer dereference. From 518e57e17f453ba2544553abb80d98806a844b20 Mon Sep 17 00:00:00 2001 From: Santhosh-I Date: Wed, 1 Jul 2026 13:53:56 +0530 Subject: [PATCH 4/4] Add test for type creation with null new metaclass --- Lib/test/test_descr.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/Lib/test/test_descr.py b/Lib/test/test_descr.py index 8a8e70214e27ae..ba504119d294fd 100644 --- a/Lib/test/test_descr.py +++ b/Lib/test/test_descr.py @@ -815,6 +815,15 @@ class X(C, int()): class X(int(), C): pass + @unittest.skipIf(_testcapi is None, 'need the _testcapi module') + def test_type_with_null_new_metaclass(self): + metaclass = _testcapi.HeapCTypeMetaclassNullNew + base = _testcapi.pytype_fromspec_meta(metaclass) + + # Exercise type_new's metaclass selection path, not a direct call. + with self.assertRaisesRegex(TypeError, r"cannot create '.*' instances"): + type("Derived", (base,), {}) + def test_module_subclasses(self): # Testing Python subclass of module... log = []