From c59aa74676676441cda8025525b39e3e81bde4b3 Mon Sep 17 00:00:00 2001 From: Yongtao Huang Date: Sun, 11 Jan 2026 22:04:50 +0800 Subject: [PATCH 1/9] Fix BufferedReader.read1 leaving object in reentrant state on error BufferedReader.read1() could leave the buffered object in a reentrant (locked) state when an exception was raised while allocating the output buffer. This change ensures the internal buffered lock is always released on error, keeping the object in a consistent state after failures. Signed-off-by: Yongtao Huang --- Modules/_io/bufferedio.c | 1 + 1 file changed, 1 insertion(+) diff --git a/Modules/_io/bufferedio.c b/Modules/_io/bufferedio.c index 4602f2b42a6017..6d779abd89ca84 100644 --- a/Modules/_io/bufferedio.c +++ b/Modules/_io/bufferedio.c @@ -1073,6 +1073,7 @@ _io__Buffered_read1_impl(buffered *self, Py_ssize_t n) PyBytesWriter *writer = PyBytesWriter_Create(n); if (writer == NULL) { + LEAVE_BUFFERED(self) return NULL; } From b8f4dcf8b37b44a75e57f7a2890e9bd4b1e53571 Mon Sep 17 00:00:00 2001 From: Yongtao Huang Date: Sun, 11 Jan 2026 22:06:30 +0800 Subject: [PATCH 2/9] Add test case --- Lib/test/test_io/test_bufferedio.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/Lib/test/test_io/test_bufferedio.py b/Lib/test/test_io/test_bufferedio.py index 3278665bdc9dd3..5f0d130f08c324 100644 --- a/Lib/test/test_io/test_bufferedio.py +++ b/Lib/test/test_io/test_bufferedio.py @@ -623,6 +623,19 @@ def test_bad_readinto_type(self): bufio.readline() self.assertIsInstance(cm.exception.__cause__, TypeError) + def test_read1_error_does_not_cause_reentrant_failure(self): + self.addCleanup(os_helper.unlink, os_helper.TESTFN) + with self.open(os_helper.TESTFN, "wb") as f: + f.write(b"hello") + + with self.open(os_helper.TESTFN, "rb", buffering=0) as raw: + bufio = self.tp(raw, buffer_size=8) + huge = 10**18 + with self.assertRaises(MemoryError): + bufio.read1(huge) + + self.assertEqual(bufio.read1(1), b"h") + class PyBufferedReaderTest(BufferedReaderTest, PyTestCase): tp = pyio.BufferedReader From c751d7adf6c39ea66fc5f80f9a66c542d85a9896 Mon Sep 17 00:00:00 2001 From: "blurb-it[bot]" <43283697+blurb-it[bot]@users.noreply.github.com> Date: Sun, 11 Jan 2026 14:14:20 +0000 Subject: [PATCH 3/9] =?UTF-8?q?=F0=9F=93=9C=F0=9F=A4=96=20Added=20by=20blu?= =?UTF-8?q?rb=5Fit.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../next/Library/2026-01-11-14-14-19.gh-issue-143689.fzHJ2W.rst | 1 + 1 file changed, 1 insertion(+) create mode 100644 Misc/NEWS.d/next/Library/2026-01-11-14-14-19.gh-issue-143689.fzHJ2W.rst diff --git a/Misc/NEWS.d/next/Library/2026-01-11-14-14-19.gh-issue-143689.fzHJ2W.rst b/Misc/NEWS.d/next/Library/2026-01-11-14-14-19.gh-issue-143689.fzHJ2W.rst new file mode 100644 index 00000000000000..c59dcba6f7088e --- /dev/null +++ b/Misc/NEWS.d/next/Library/2026-01-11-14-14-19.gh-issue-143689.fzHJ2W.rst @@ -0,0 +1 @@ +Fixed BufferedReader.read1() leaving the object in a reentrant state after an error. From 5956576d8fea03526180552c7729d4c89acd1def Mon Sep 17 00:00:00 2001 From: Yongtao Huang Date: Sun, 11 Jan 2026 23:00:15 +0800 Subject: [PATCH 4/9] Update test case --- Lib/test/test_io/test_bufferedio.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/Lib/test/test_io/test_bufferedio.py b/Lib/test/test_io/test_bufferedio.py index 5f0d130f08c324..8789a1d7207686 100644 --- a/Lib/test/test_io/test_bufferedio.py +++ b/Lib/test/test_io/test_bufferedio.py @@ -624,6 +624,15 @@ def test_bad_readinto_type(self): self.assertIsInstance(cm.exception.__cause__, TypeError) def test_read1_error_does_not_cause_reentrant_failure(self): + # 32-bit builds (e.g. win32) can raise OverflowError + # converting huge Python int to Py_ssize_t. + if sys.maxsize <= 2**32: + self.skipTest("requires 64-bit build") + # Under TSan, the process may abort on huge allocation + # attempts (exit code 66). + if support.check_sanitizer(thread=True): + self.skipTest("TSan aborts on huge allocations") + self.addCleanup(os_helper.unlink, os_helper.TESTFN) with self.open(os_helper.TESTFN, "wb") as f: f.write(b"hello") From bab615a24d59fb4b260a443ed7a128476819708b Mon Sep 17 00:00:00 2001 From: Yongtao Huang Date: Mon, 12 Jan 2026 06:30:52 +0800 Subject: [PATCH 5/9] Update Misc/NEWS.d/next/Library/2026-01-11-14-14-19.gh-issue-143689.fzHJ2W.rst Co-authored-by: Cody Maloney --- .../next/Library/2026-01-11-14-14-19.gh-issue-143689.fzHJ2W.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Misc/NEWS.d/next/Library/2026-01-11-14-14-19.gh-issue-143689.fzHJ2W.rst b/Misc/NEWS.d/next/Library/2026-01-11-14-14-19.gh-issue-143689.fzHJ2W.rst index c59dcba6f7088e..a423b1b70ad077 100644 --- a/Misc/NEWS.d/next/Library/2026-01-11-14-14-19.gh-issue-143689.fzHJ2W.rst +++ b/Misc/NEWS.d/next/Library/2026-01-11-14-14-19.gh-issue-143689.fzHJ2W.rst @@ -1 +1 @@ -Fixed BufferedReader.read1() leaving the object in a reentrant state after an error. +Fix :meth:`io.BufferedReader.read1` state cleanup on buffer allocation failure. From 544a44d7464e11b0aaa6dcc304d2f473e09bf215 Mon Sep 17 00:00:00 2001 From: Yongtao Huang Date: Mon, 12 Jan 2026 06:34:55 +0800 Subject: [PATCH 6/9] Resolved comments --- Lib/test/test_io/test_bufferedio.py | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/Lib/test/test_io/test_bufferedio.py b/Lib/test/test_io/test_bufferedio.py index 8789a1d7207686..b6eaab85409b45 100644 --- a/Lib/test/test_io/test_bufferedio.py +++ b/Lib/test/test_io/test_bufferedio.py @@ -10,6 +10,7 @@ from collections import deque, UserList from itertools import cycle, count from test import support +from test.support import check_sanitizer from test.support import os_helper, threading_helper from .utils import byteslike, CTestCase, PyTestCase @@ -623,16 +624,10 @@ def test_bad_readinto_type(self): bufio.readline() self.assertIsInstance(cm.exception.__cause__, TypeError) + @unittest.skipUnless(sys.maxsize > 2**32, 'requires 64bit platform') + @unittest.skipIf(check_sanitizer(thread=True), + 'ThreadSanitizer aborts on huge allocations (exit code 66).') def test_read1_error_does_not_cause_reentrant_failure(self): - # 32-bit builds (e.g. win32) can raise OverflowError - # converting huge Python int to Py_ssize_t. - if sys.maxsize <= 2**32: - self.skipTest("requires 64-bit build") - # Under TSan, the process may abort on huge allocation - # attempts (exit code 66). - if support.check_sanitizer(thread=True): - self.skipTest("TSan aborts on huge allocations") - self.addCleanup(os_helper.unlink, os_helper.TESTFN) with self.open(os_helper.TESTFN, "wb") as f: f.write(b"hello") From fbad9a20177054e41997e6205832088c975e73fe Mon Sep 17 00:00:00 2001 From: Yongtao Huang Date: Mon, 12 Jan 2026 10:15:55 +0800 Subject: [PATCH 7/9] Update Lib/test/test_io/test_bufferedio.py Co-authored-by: sobolevn --- Lib/test/test_io/test_bufferedio.py | 1 + 1 file changed, 1 insertion(+) diff --git a/Lib/test/test_io/test_bufferedio.py b/Lib/test/test_io/test_bufferedio.py index b6eaab85409b45..a59698671bcd54 100644 --- a/Lib/test/test_io/test_bufferedio.py +++ b/Lib/test/test_io/test_bufferedio.py @@ -638,6 +638,7 @@ def test_read1_error_does_not_cause_reentrant_failure(self): with self.assertRaises(MemoryError): bufio.read1(huge) + # Used to crash before gh-143689: self.assertEqual(bufio.read1(1), b"h") From e36ddf652cb4ef1b9a1e86382fea9eb3f3fe2314 Mon Sep 17 00:00:00 2001 From: Yongtao Huang Date: Mon, 12 Jan 2026 10:45:15 +0800 Subject: [PATCH 8/9] Add comments of test case --- Lib/test/test_io/test_bufferedio.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Lib/test/test_io/test_bufferedio.py b/Lib/test/test_io/test_bufferedio.py index a59698671bcd54..fca737fde5227e 100644 --- a/Lib/test/test_io/test_bufferedio.py +++ b/Lib/test/test_io/test_bufferedio.py @@ -634,7 +634,9 @@ def test_read1_error_does_not_cause_reentrant_failure(self): with self.open(os_helper.TESTFN, "rb", buffering=0) as raw: bufio = self.tp(raw, buffer_size=8) - huge = 10**18 + # To request a size that is far too huge to ever be satisfied, + # so that the internal buffer allocation reliably fails with MemoryError. + huge = sys.maxsize // 2 + 1 with self.assertRaises(MemoryError): bufio.read1(huge) From f30580497afcfce1228a1662bda20afb083b0d8b Mon Sep 17 00:00:00 2001 From: Yongtao Huang Date: Mon, 12 Jan 2026 14:59:20 +0800 Subject: [PATCH 9/9] Trigger 32bit CI --- Lib/test/test_io/test_bufferedio.py | 1 - 1 file changed, 1 deletion(-) diff --git a/Lib/test/test_io/test_bufferedio.py b/Lib/test/test_io/test_bufferedio.py index fca737fde5227e..aa53c3422b5ce3 100644 --- a/Lib/test/test_io/test_bufferedio.py +++ b/Lib/test/test_io/test_bufferedio.py @@ -624,7 +624,6 @@ def test_bad_readinto_type(self): bufio.readline() self.assertIsInstance(cm.exception.__cause__, TypeError) - @unittest.skipUnless(sys.maxsize > 2**32, 'requires 64bit platform') @unittest.skipIf(check_sanitizer(thread=True), 'ThreadSanitizer aborts on huge allocations (exit code 66).') def test_read1_error_does_not_cause_reentrant_failure(self):