[New-bugs-announce] [issue39276] type() cause segmentation fault in callback function called from C extension

[Paweł Karczewski]

New submission from Paweł Karczewski <pawel.karczewski at intel.com>:

How to reproduce:

1. Create callback function, which may take any object and run type() on it
  def builtin_type_in_callback(obj):
          type(obj)

2. Create C extension with two types defined in it - Internal and External. 
  Eternal type should implement method (let's name it Call), which can get callback function

		static PyObject *
		Call(ExternalObject *self, PyObject* args) {
		PyObject* python_callback;
		if (!PyArg_ParseTuple(args, "O:set_callback",  &python_callback)) {
			return NULL;
		}
		callback_runner(python_callback);
		if(PyErr_Occurred() != NULL)
			return NULL;
		Py_RETURN_NONE;
		}  
  Inside this function create object of Internal type and pass it to callback function
	void callback_runner(void* callback_function)  {
		InternalObject *entry = PyObject_New(InternalObject, &InternalType);
		PyObject_Init((PyObject*)entry, &InternalType);
		PyObject *args = PyTuple_New(1);
		if (args != NULL) {
			if (PyTuple_SetItem(args, 0, (PyObject *)entry) == 0) {
				PyObject *res = PyObject_CallObject((PyObject *) callback_function, args);
				Py_XDECREF(res);
			}
		}
		
When type() is called on object of Internal type segmentation fault occur. However, if dir() was called
on such object before type(), type() works properly and returns type of Internal Object.

For more details please look into reproducer code.

----------
components: C API
files: cpython_type_segfaulter.tgz
messages: 359680
nosy: karczex
priority: normal
severity: normal
status: open
title: type() cause segmentation fault  in callback function called from C extension
versions: Python 3.7, Python 3.8
Added file: https://bugs.python.org/file48834/cpython_type_segfaulter.tgz

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue39276>
_______________________________________