← index #17714Issue #17846
Related · high · value 1.926
QUERY · ISSUE

virtpin: crash with improper usage

openby jepleropened 2025-07-19updated 2025-07-19
bug

Port, board and/or hardware

unix port, longlong variant

MicroPython version

MicroPython v1.26.0-preview.389.gb795cd238a.dirty

Reproduction

Pass a wrong object to the first argument of time_pulse_us:

$ build-longlong/micropython  -c 'import machine; machine.time_pulse_us(object(), 1)'
Segmentation fault

Expected behaviour

An exception is raised

Observed behaviour

Program received signal SIGSEGV, Segmentation fault.
0x000055555564b0be in mp_virtual_pin_read (pin=pin@entry=0x7ffff7c45b80)
    at ../../extmod/virtpin.c:32
32	    return pin_p->ioctl(pin, MP_PIN_READ, 0, NULL);

Additional Information

This finding is based on fuzzing micropython. I manually minimized the test case it provided.

Code of Conduct

Yes, I agree

CANDIDATE · ISSUE

framebuf: crash with incorrect usage (native subclassing?)

openby jepleropened 2025-08-06updated 2025-08-06
bug

Port, board and/or hardware

unix port, coverage build, x86_64 linux

MicroPython version

MicroPython v1.26.0-preview.524.g255d74b5a8 on 2025-08-06; linux [GCC 12.2.0] version

Reproduction

Run the following Python code:

import framebuf
class FB(framebuffer.FrameBuffer): pass
FB.pixel(0,0,0)

Expected behaviour

A TypeError or other appropriate error is raised

Observed behaviour

A segmentation fault.

MicroPython v1.26.0-preview.524.g255d74b5a8 on 2025-08-06; linux [GCC 12.2.0] version
Use Ctrl-D to exit, Ctrl-E for paste mode
>>> import framebuf
>>> class FB(framebuf.FrameBuffer): pass
... 
>>> FB.pixel(0,0,0)

Program received signal SIGSEGV, Segmentation fault.
0x0000555555634845 in framebuf_pixel (n_args=3, args_in=0x7fffffffda30)
    at ../../extmod/modframebuf.c:376
376	    if (0 <= x && x < self->width && 0 <= y && y < self->height) {
(gdb) where
#0  0x0000555555634845 in framebuf_pixel (n_args=3, args_in=0x7fffffffda30)
    at ../../extmod/modframebuf.c:376
#1  0x00005555555fdf8d in fun_builtin_var_call (
    self_in=0x555555711250 <framebuf_pixel_obj>, n_args=3, n_kw=0, args=0x7fffffffda30)
    at ../../py/objfun.c:123

Additional Information

This was found by fuzzing.

Incidentally, when there is NOT a subclass involved, the error is detected:

>>> framebuf.FrameBuffer.pixel(0,0,0)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
TypeError: argument should be a 'FrameBuffer' not a 'int'

Code of Conduct

Yes, I agree

Keyboard

j / / n
next pair
k / / p
previous pair
1 / / h
show query pane
2 / / l
show candidate pane
c
copy suggested comment
r
toggle reasoning
g i
go to index
?
show this help
esc
close overlays

press ? or esc to close

copied