Skip to content

gh-154709: Fix out-of-bounds access in dict reverse iterator#154721

Open
BHUVANSH855 wants to merge 1 commit into
python:mainfrom
BHUVANSH855:fix-154709-dict-reviter-bounds
Open

gh-154709: Fix out-of-bounds access in dict reverse iterator#154721
BHUVANSH855 wants to merge 1 commit into
python:mainfrom
BHUVANSH855:fix-154709-dict-reviter-bounds

Conversation

@BHUVANSH855

@BHUVANSH855 BHUVANSH855 commented Jul 26, 2026

Copy link
Copy Markdown
Contributor

Summary

Fix an out-of-bounds access in dictreviter_iter_lock_held() when a reverse dictionary iterator is used after the underlying dictionary is cleared and modified.

The fix adds bounds checks before indexing into the dictionary's storage for both split-table and combined-table dictionaries. If the iterator's position is no longer valid, it now exits cleanly instead of accessing invalid memory.

A regression test has also been added to verify that this scenario no longer results in a crash.

Testing

  • Reproduced the original crash using the provided reproducer before the fix.
  • Verified that the reproducer no longer crashes after the fix.
  • Ran:
    • ./python -m test test_dict
    • ./python -m test test_gc
    • ./python -m test test_builtin
    • ./python -m test test_dict test_gc test_builtin

@BHUVANSH855
BHUVANSH855 force-pushed the fix-154709-dict-reviter-bounds branch from 57fb030 to f6d8284 Compare July 26, 2026 09:08
Comment thread Objects/dictobject.c
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants