Skip to content

BUG: in-place string multiply leads to heap buffer overflow. #30495

@BergLucas

Description

@BergLucas

Describe the issue:

Hi,

For a research paper, we carried out a large-scale benchmark of Pynguin, an Automatic Unit Test Generation Tool for Python, to test its new feature that can find Python interpreter crashes. In this benchmark, we found a potential bug in numpy, and we are reporting this issue.

The example was run with the command python -X faulthandler <test> to dump the traceback.

Reproduce the code example:

import numpy.polynomial.legendre as legendre

legendre.legder(("0", "0"), scl=20)

Error message:

Fatal Python error: Segmentation fault

Current thread 0x00007f3e28300bc0 [python] (most recent call first):
  Garbage-collecting
  <no Python frame>

Current thread's C stack trace (most recent call first):
  Binary file "/lib64/libpython3.14.so.1.0", at _Py_DumpStack+0x4c [0x7f3e27d213fa]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x121e7e [0x7f3e27d21e7e]
  Binary file "/lib64/libc.so.6", at +0x1a2c0 [0x7f3e27a262c0]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x1facd8 [0x7f3e27dfacd8]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x183bf9 [0x7f3e27d83bf9]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x1fab68 [0x7f3e27dfab68]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x1fa12a [0x7f3e27dfa12a]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x25ed69 [0x7f3e27e5ed69]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x27fcd1 [0x7f3e27e7fcd1]
  Binary file "/lib64/libpython3.14.so.1.0", at Py_RunMain+0x231 [0x7f3e27e52401]
  Binary file "/lib64/libpython3.14.so.1.0", at Py_BytesMain+0x3b [0x7f3e27e4c75b]
  Binary file "/lib64/libc.so.6", at +0x35b5 [0x7f3e27a0f5b5]
  Binary file "/lib64/libc.so.6", at __libc_start_main+0x88 [0x7f3e27a0f668]
  Binary file "python", at _start+0x25 [0x55c7863453d5]

Extension modules: numpy._core._multiarray_umath, numpy.linalg._umath_linalg (total: 2)
Segmentation fault         (core dumped)

Python and NumPy Versions:

2.4.0
3.14.0 (main, Oct 17 2025, 00:00:00) [GCC 15.2.1 20251022 (Red Hat 15.2.1-3)]

Runtime Environment:

[{'numpy_version': '2.4.0',
'python': '3.14.0 (main, Oct 17 2025, 00:00:00) [GCC 15.2.1 20251022 (Red '
'Hat 15.2.1-3)]',
'uname': uname_result(system='Linux', node='lucas-hp', release='6.17.10-300.fc43.x86_64', version='#1 SMP PREEMPT_DYNAMIC Mon Dec 1 14:59:36 UTC 2025', machine='x86_64')},
{'simd_extensions': {'baseline': ['X86_V2'],
'found': ['X86_V3'],
'not_found': ['X86_V4', 'AVX512_ICL', 'AVX512_SPR']}},
{'ignore_floating_point_errors_in_matmul': False},
{'architecture': 'Haswell',
'filepath': '/home/lucas/Documents/crashes/.venv/lib/python3.14/site-packages/numpy.libs/libscipy_openblas64_-fdde5778.so',
'internal_api': 'openblas',
'num_threads': 12,
'prefix': 'libscipy_openblas',
'threading_layer': 'pthreads',
'user_api': 'blas',
'version': '0.3.30'}]

How does this issue affect you or how did you find it:

It's not a serious problem, but we thought it was important to at least warn you that this behaviour exists, so that you can take the action that suits you best.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions