Repository navigation
Various UB warnings found by UBSan #148286
Description
Bug report
Bug description:
These were all found by UBSan in our CI (it just hasn't been complaining about them). They need to be individually checked, some may be false positives.
# Objects/object.c:97:5: runtime error: member access within null pointer of type 'PyThreadState' (aka 'struct _ts')
null:Objects/object.c
In test_memoryview:
# Objects/memoryobject.c:3032:15: runtime error: load of value 2, which is not a valid value for type 'bool'
bool:Objects/memoryobject.c
In test_ctypes:
# Modules/_ctypes/cfield.c:644:1: runtime error: left shift of 1 by 63 places cannot be represented in type 'int64_t' (aka 'long')
shift-base:Modules/_ctypes/cfield.c
# Modules/_ctypes/cfield.c:640:1: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
signed-integer-overflow:Modules/_ctypes/cfield.c
In test_zstd:
# Modules/_zstd/decompressor.c:598:56: runtime error: applying non-zero offset 18446744073709551615 to null pointer
pointer-overflow:Modules/_zstd/decompressor.c
# Modules/_io/stringio.c:350:24: runtime error: addition of unsigned offset to 0x7fd01ec25850 overflowed to 0x7fd01ec2584c
pointer-overflow:Modules/_io/stringio.c
# Objects/bytesobject.c:1190:25: runtime error: applying zero offset to null pointer
pointer-overflow:Objects/bytesobject.c
CPython versions tested on:
CPython main branch
Operating systems tested on:
No response
Linked PRs
- gh-148286: Run test_capi and test_faulthandler on GHA UBSan #151274
- gh-148286: Fail on new UB in CI #148168
- gh-148286: Remove invalid test in
test_decodeescape#153187 - [3.15] gh-148286: Remove invalid test in
test_decodeescape(GH-153187) #153204 - gh-148286: Fix UB in
ZstdDecompressor.unused_datawhen a frame is decompressed in one call #153258 - [3.15] gh-148286: Fix UB in
ZstdDecompressor.unused_datawhen a frame is decompressed in one call (GH-153258) #153644 - [3.14] gh-148286: Fix UB in
ZstdDecompressor.unused_datawhen a frame is decompressed in one call (GH-153258) #153645 - gh-148286: Fix undefined behaviour in the ctypes bit field accessors #154912
- gh-148286: Fix undefined behaviour in io.StringIO.read() after an overseek #154913
- gh-148286: Fix undefined behaviour in per-thread refcount merging #154915
- gh-148286: Track JIT-allocated memory with Valgrind client requests #154926
Activity
gh-148286: Fail when new UB is found by CI UBSan (#148168)
picnixz commentedon Apr 11, 2026
I can confirm the memoryview() UB:
The others look random and probably are so.
picnixz commentedon Apr 11, 2026
So the memoryview UBSan is more severe than I expected (see #83870 for the past history as well). I will create a new issue.
picnixz commentedon Apr 11, 2026
For now, I will not investigate the others because I wasn't able to catch them with clang (but it may be other build configurations).
pythongh-148286: Fail when new UB is found by CI UBSan (python#148168)
gh-148286: Remove invalid test in `test_decodeescape` (#153187)
[3.15] gh-148286: Remove invalid test in `test_decodeescape` (GH-153187…
gh-148286: Fix UB in `ZstdDecompressor.unused_data` when a frame is d…
[3.14] gh-148286: Fix UB in `ZstdDecompressor.unused_data` when a fra…
[3.15] gh-148286: Fix UB in `ZstdDecompressor.unused_data` when a fra…
matthiasgoergens commentedon Jul 30, 2026
While working through the
Modules/_ctypes/cfield.candModules/_io/stringio.centries on this list I ran the suppression file against some configurations CI does not currently build, and turned up one more UB site that is not on the list above. Recording it here rather than opening a separate issue, since it is the same class of thing.Python/uniqueid.c:185, free-threaded builds only._PyObject_MergePerThreadRefcounts()doesrefcnt << _Py_REF_SHARED_SHIFTwhererefcntis a per-thread delta and is almost always-1. Fix in #154915.The reason it is not on the list is structural: the sanitizer matrix in
.github/workflows/build.ymlpairs UBSan only withfree-threading: false, soPython/uniqueid.cis never built under UBSan. It is not an obscure path either — the first line of output from./python -c passon a--disable-gil --with-undefined-behavior-sanitizerbuild is the UBSan report, raised during interpreter startup, and it recurs fromgc_collect_mainon every collection. Over the full suite with all suppressions disabled: 1762 reports, 529 test failures across 61 files, going to zero with the fix.Two smaller findings from the same sweep, in case they are useful:
local-boundsis not part of theundefinedgroup that--with-undefined-behavior-sanitizerenables, so it runs nowhere today. I built with it enabled and ran the full suite: zero findings, including no false positives from the trailing variable-length array idiom, which was the thing I expected to cause noise. It looks like a free check to add.float-divide-by-zero, also not in theundefinedgroup, produces exactly one hit:Modules/expat/xmlparse.c:869, in vendored libexpat, which deliberately relies on IEEE-754+infand says so in a comment, with anassert(newTotal > 0)above guaranteeing it is notNaN. Technically UB in C, intentional in practice — so this one probably is not worth enabling without excluding expat.Happy to open separate issues for either if that is preferred.
pythongh-148286: Fix undefined behaviour in io.StringIO.read() after …
pythongh-148286: Fix undefined behaviour in per-thread refcount mergi…
pythongh-148286: Track JIT-allocated memory with Valgrind client requ…
pythongh-148286: Fix undefined behaviour in the ctypes bit field acce…
pythongh-148286: Fix undefined behaviour in per-thread refcount mergi…