From cb16046654db85a11f765d1f8ad802bdf895654f Mon Sep 17 00:00:00 2001 From: Santhosh-I Date: Mon, 22 Jun 2026 15:26:31 +0530 Subject: [PATCH 1/3] Fix segfault in type() with NULL tp_new metaclasses --- Objects/typeobject.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Objects/typeobject.c b/Objects/typeobject.c index 59593fd0f6a0b78..7848f1c17607111 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -5031,6 +5031,13 @@ type_new_get_bases(type_new_ctx *ctx, PyObject **type) if (winner != ctx->metatype) { if (winner->tp_new != type_new) { + /* Check if tp_new is NULL (cannot instantiate this type) */ + if (winner->tp_new == NULL) { + PyErr_Format(PyExc_TypeError, + "cannot create '%.400s' instances", + winner->tp_name); + return -1; + } /* Pass it to the winner */ *type = winner->tp_new(winner, ctx->args, ctx->kwds); if (*type == NULL) { From 7d1432e3c5ed2aa37454b63687405ed61b2b84a7 Mon Sep 17 00:00:00 2001 From: "blurb-it[bot]" <43283697+blurb-it[bot]@users.noreply.github.com> Date: Mon, 22 Jun 2026 14:48:24 +0000 Subject: [PATCH 2/3] =?UTF-8?q?=F0=9F=93=9C=F0=9F=A4=96=20Added=20by=20blu?= =?UTF-8?q?rb=5Fit.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst | 1 + 1 file changed, 1 insertion(+) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst new file mode 100644 index 000000000000000..f0b7b860e76b298 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst @@ -0,0 +1 @@ +Fixed a crash in `type()` when selecting a metaclass whose `tp_new` slot is `NULL`. Such metaclasses are now rejected with `TypeError` instead of causing a NULL pointer dereference. From 3e9e1642b525e10dc5194ebc6351bc592af7ec45 Mon Sep 17 00:00:00 2001 From: Santhosh-I Date: Tue, 23 Jun 2026 13:58:14 +0530 Subject: [PATCH 3/3] Fix formatting in NEWS entry for type() crash fix --- .../2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst index f0b7b860e76b298..07b73949b438a33 100644 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-14-48-22.gh-issue-151912.YcxfnU.rst @@ -1 +1 @@ -Fixed a crash in `type()` when selecting a metaclass whose `tp_new` slot is `NULL`. Such metaclasses are now rejected with `TypeError` instead of causing a NULL pointer dereference. +Fixed a crash in ``type()`` when selecting a metaclass whose ``tp_new`` slot is ``NULL``. Such metaclasses are now rejected with ``TypeError`` instead of causing a NULL pointer dereference.