Repository navigation
SystemError from termios.tcsetwinsizepassing NULL to PyLong_AsLong #146091
Description
Crash report
What happened?
It's possible to raise SystemError from termios.tcsetwinsize by passing a sequence that raises on __getitem__ to it.
Automated diagnosis:
Bug: termios.tcsetwinsize passes NULL to PyLong_AsLong. PySequence_GetItem(winsz, 0) can return NULL (e.g., __getitem__ raises). The result is passed directly to PyLong_AsLong(NULL) which calls PyErr_BadInternalCall(), masking the real error with SystemError.
File: Modules/termios.c, lines 502-510
MRE:
import termios
import os
fd = os.open("/dev/tty", os.O_RDWR | os.O_NOCTTY)
class BadSequence:
def __len__(self):
return 2
def __getitem__(self, idx):
raise TypeError
termios.tcsetwinsize(fd, BadSequence())Backtrace:
Traceback (most recent call last):
File "/home/danzin/crashers/trigger_termios_null_pylong.py", line 23, in <module>
termios.tcsetwinsize(fd, BadSequence())
~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
SystemError: Objects/longobject.c:598: bad argument to internal functionFound using cpython-review-toolkit with Claude Opus 4.6, using the /cpython-review-toolkit:explore Modules/termios.c all deep command.
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Output from running 'python -VV' on the command line:
Python 3.15.0a7+ (heads/main:e0f7c1097e1, Mar 17 2026, 18:10:52) [Clang 21.1.2 (2ubuntu6)]
Activity
okiemute04 commentedon Mar 18, 2026
@devdanzin This is interesting. Let me work on this issue. I do understand the problem is that PySequence_GetItem can return NULL, which gets passed to PyLong_AsLong, causing a SystemError instead of the original exception. I'll add NULL checks and proper error propagation, and any suggestions that can help?
pythongh-146091: Fix NULL check in termios.tcsetwinsize
pythongh-146091: Fix NULL check in termios.tcsetwinsize
pythongh-146091: Fix NULL check in termios.tcsetwinsize
gh-146091: Fix NULL check in termios.tcsetwinsize (#146147)
pythongh-146091: Fix NULL check in termios.tcsetwinsize (python#146147)