Skip to content

Segfault on repr of instances of _ItemsView, _KeysView or _ValuesView #1161

@devdanzin

Description

@devdanzin

Directly building an instance of _ItemsView, _KeysView or _ValuesView and calling repr on it will lead to a segfault. Instances created by calling the corresponding methods(e.g. MultiDict(a=1).keys()) don't suffer from this.

>>> import multidict
>>> repr(multidict._ItemsView())

Program received signal SIGSEGV, Segmentation fault.

0x00007ffff6d11494 in pair_list_repr (list=0x10, name=0x7ffff6aa5940, show_keys=true,
    show_values=true) at multidict/_multilib/pair_list.h:1517
#0  0x00007ffff6d11494 in pair_list_repr (list=0x10, name=0x7ffff6aa5940, show_keys=true,
    show_values=true) at multidict/_multilib/pair_list.h:1517
#1  0x00007ffff6d11b4d in multidict_itemsview_repr (self=0x7ffff6c443d0)
    at multidict/_multilib/views.h:187
#2  0x00005555556cb1c9 in PyObject_Repr (v=v@entry=0x7ffff6c443d0) at Objects/object.c:765
#3  0x0000555555691073 in PyFile_WriteObject (v=v@entry=0x7ffff6c443d0, f=f@entry=0x7ffff7475400,
    flags=flags@entry=0) at Objects/fileobject.c:120
#4  0x0000555555835aa0 in sys_displayhook (module=<optimized out>, o=o@entry=0x7ffff6c443d0)
    at ./Python/sysmodule.c:825
#5  0x00005555556c6490 in cfunction_vectorcall_O (func=0x7ffff75a24b0, args=<optimized out>,
    nargsf=<optimized out>, kwnames=<optimized out>) at Objects/methodobject.c:512
#6  0x00005555556746fa in _PyObject_VectorcallTstate (tstate=0x555555b604c0 <_PyRuntime+299040>,
    callable=callable@entry=0x7ffff75a24b0, args=args@entry=0x7fffffffcd68,
    nargsf=nargsf@entry=9223372036854775809, kwnames=kwnames@entry=0x0)
    at ./Include/internal/pycore_call.h:168
#7  0x0000555555674826 in PyObject_CallOneArg (func=func@entry=0x7ffff75a24b0,
    arg=arg@entry=0x7ffff6c443d0) at Objects/call.c:395
#8  0x0000555555807788 in print_expr (_unused_ignored=<optimized out>, value=0x7ffff6c443d0)
    at Python/intrinsics.c:33
#9  0x00005555557a5098 in _PyEval_EvalFrameDefault (tstate=0x555555b604c0 <_PyRuntime+299040>,
    frame=0x7ffff7fb05f0, throwflag=0) at Python/generated_cases.c.h:1376
#10 0x00005555557b4b05 in _PyEval_EvalFrame (
    tstate=tstate@entry=0x555555b604c0 <_PyRuntime+299040>, frame=<optimized out>,
    throwflag=throwflag@entry=0) at ./Include/internal/pycore_ceval.h:119
#11 0x00005555557b4c34 in _PyEval_Vector (tstate=tstate@entry=0x555555b604c0 <_PyRuntime+299040>,
    func=func@entry=0x7ffff6fa9d90, locals=locals@entry=0x7ffff7463d70, args=args@entry=0x0,
    argcount=argcount@entry=0, kwnames=kwnames@entry=0x0) at Python/ceval.c:1816
#12 0x00005555557b4cf7 in PyEval_EvalCode (co=co@entry=0x7ffff6bca460,
    globals=globals@entry=0x7ffff7463d70, locals=locals@entry=0x7ffff7463d70)
    at Python/ceval.c:604
#13 0x00005555557988e1 in builtin_exec_impl (module=module@entry=0x7ffff75a6930,
    source=0x7ffff6bca460, globals=0x7ffff7463d70, locals=0x7ffff7463d70, closure=0x0)
    at Python/bltinmodule.c:1143
#14 0x0000555555798a44 in builtin_exec (module=0x7ffff75a6930, args=<optimized out>,
    args@entry=0x7ffff7fb05e0, nargs=nargs@entry=2, kwnames=kwnames@entry=0x0)
    at Python/clinic/bltinmodule.c.h:556

multidict.__version__

'6.4.3'

Python versions:

Python 3.13.3+ (heads/3.13:fdcaaad1cc7, Apr 27 2025, 10:17:23) [GCC 14.2.0] on linux

Found using fusil by @vstinner.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions