From 287f4032da8c854553a9e3770996025122b3d3eb Mon Sep 17 00:00:00 2001 From: Bhuvansh Kataria Date: Sat, 8 Aug 2026 13:55:59 +0000 Subject: [PATCH 1/3] gh-155376: prevent supercheck NULL dereference --- Lib/test/test_super.py | 5 +++++ .../Core_and_Builtins/2026-08-08.gh-issue-155376.rst | 2 ++ Objects/typeobject.c | 9 +++++++-- 3 files changed, 14 insertions(+), 2 deletions(-) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-08-08.gh-issue-155376.rst diff --git a/Lib/test/test_super.py b/Lib/test/test_super.py index 193c8b7d7f3e131..c4d6b1a5d8fcb84 100644 --- a/Lib/test/test_super.py +++ b/Lib/test/test_super.py @@ -437,6 +437,11 @@ def method(self, type_, obj): with self.assertRaisesRegex(TypeError, regex): c.method(type_, obj) + def test_supercheck_uninitialized_super(self): + s = super.__new__(super) + with self.assertRaisesRegex(TypeError, "super object has no type"): + s.__get__(1) + def test_super___class__(self): class C: def method(self): diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-08.gh-issue-155376.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-08.gh-issue-155376.rst new file mode 100644 index 000000000000000..e78edd6f7e6f8c6 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-08.gh-issue-155376.rst @@ -0,0 +1,2 @@ +Fix a crash in :func:`super` when an uninitialized ``super`` object created +with ``super.__new__(super)`` was used as a descriptor. diff --git a/Objects/typeobject.c b/Objects/typeobject.c index e3026397c8673f1..8163c516350e974 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -12562,6 +12562,12 @@ supercheck(PyTypeObject *type, PyObject *obj) This will allow using super() with a proxy for obj. */ + if (type == NULL) { + PyErr_SetString(PyExc_TypeError, + "super object has no type"); + return NULL; + } + /* Check for first bullet above (special case) */ if (PyType_Check(obj) && PyType_IsSubtype((PyTypeObject *)obj, type)) { return (PyTypeObject *)Py_NewRef(obj); @@ -12642,8 +12648,7 @@ super_descr_get(PyObject *self, PyObject *obj, PyObject *type) PyTypeObject *obj_type = supercheck(su->type, obj); if (obj_type == NULL) return NULL; - newobj = (superobject *)PySuper_Type.tp_new(&PySuper_Type, - NULL, NULL); + newobj = (superobject *)PySuper_Type.tp_alloc(&PySuper_Type, 0); if (newobj == NULL) { Py_DECREF(obj_type); return NULL; From c15c0bb88a9ce02d9218f9469db42b2ac6c419ec Mon Sep 17 00:00:00 2001 From: Bhuvansh Kataria Date: Sat, 8 Aug 2026 14:05:04 +0000 Subject: [PATCH 2/3] gh-155376: fix NEWS entry filename --- .../2026-08-08-14-04-39.gh-issue-155376.NkZ4mI.rst | 2 ++ .../next/Core_and_Builtins/2026-08-08.gh-issue-155376.rst | 2 -- 2 files changed, 2 insertions(+), 2 deletions(-) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-08-08-14-04-39.gh-issue-155376.NkZ4mI.rst delete mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-08-08.gh-issue-155376.rst diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-08-14-04-39.gh-issue-155376.NkZ4mI.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-08-14-04-39.gh-issue-155376.NkZ4mI.rst new file mode 100644 index 000000000000000..9844019cb09ed29 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-08-14-04-39.gh-issue-155376.NkZ4mI.rst @@ -0,0 +1,2 @@ +Fix a crash in :func:`super` when an uninitialized `super` object created +with `super.__new__(super)` was used as a descriptor. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-08.gh-issue-155376.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-08.gh-issue-155376.rst deleted file mode 100644 index e78edd6f7e6f8c6..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-08.gh-issue-155376.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix a crash in :func:`super` when an uninitialized ``super`` object created -with ``super.__new__(super)`` was used as a descriptor. From fdcf59d5d532dbc3f0e84e838768f2babf30c8a0 Mon Sep 17 00:00:00 2001 From: Bhuvansh Kataria Date: Sat, 8 Aug 2026 14:09:20 +0000 Subject: [PATCH 3/3] gh-155376: fix NEWS entry formatting --- .../2026-08-08-14-04-39.gh-issue-155376.NkZ4mI.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-08-14-04-39.gh-issue-155376.NkZ4mI.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-08-14-04-39.gh-issue-155376.NkZ4mI.rst index 9844019cb09ed29..e78edd6f7e6f8c6 100644 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-08-14-04-39.gh-issue-155376.NkZ4mI.rst +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-08-14-04-39.gh-issue-155376.NkZ4mI.rst @@ -1,2 +1,2 @@ -Fix a crash in :func:`super` when an uninitialized `super` object created -with `super.__new__(super)` was used as a descriptor. +Fix a crash in :func:`super` when an uninitialized ``super`` object created +with ``super.__new__(super)`` was used as a descriptor.