← index #17727Issue #17728
Related · high · value 1.917
QUERY · ISSUE

crash in io.BufferedWriter due to missing argument validation

openby jepleropened 2025-07-20updated 2025-07-20
bug

Port, board and/or hardware

unix coverage port

MicroPython version

MicroPython v1.26.0-preview.387.ge4e97f5aa7.dirty on 2025-07-20; linux [GCC 12.2.0] version

Reproduction

Run the following script:

import io
io.BufferedWriter(None, 1).write(b"foo")

Expected behaviour

Some kind of exception like a TypeError

Observed behaviour

Segmentation fault:

Program received signal SIGSEGV, Segmentation fault.
mp_stream_rw (stream=0x6, buf_=buf_@entry=0x7ffff7c30ba0, size=1, 
    errcode=errcode@entry=0x7fffffffd83c, flags=flags@entry=2 '\002')
    at ../../py/stream.c:50
50	    const mp_stream_p_t *stream_p = mp_get_stream(stream);
(gdb) p stream
$3 = (mp_obj_t) 0x6

Additional Information

Minimal validation of the suitablity of the stream object is missing.

This crash was found via automated fuzzing. I minimized the test case the fuzzer found.

Code of Conduct

Yes, I agree

CANDIDATE · ISSUE

segfault with improper use of super()

openby jepleropened 2025-07-20updated 2025-07-20
bug

Port, board and/or hardware

unix, coverage build

MicroPython version

MicroPython v1.26.0-preview.387.ge4e97f5aa7.dirty on 2025-07-20; linux [GCC 12.2.0] version

Reproduction

Run the following code:

import framebuf

class FB(framebuf.FrameBuffer):
    def __init__(self, n):
        self = n
        super().__init__(bytearray(2 * n * n), n, n, framebuf.RGB565)

fb = FB(n=3)

Expected behaviour

super() should not segfault.

Observed behaviour

crash in native_base_init_wrapper

Program received signal SIGSEGV, Segmentation fault.
0x00005555556120c7 in native_base_init_wrapper (n_args=5, args=0x7fffffffd6c0, 
    kw_args=0x7fffffffd510) at ../../py/objtype.c:91
91	    instance_count_native_bases(self->base.type, &native_base);
(gdb) p self
$1 = (mp_obj_instance_t *) 0x7

Additional Information

This is a minimized version of a script produced by fuzzing micropython.

Code of Conduct

Yes, I agree

Keyboard

j / / n
next pair
k / / p
previous pair
1 / / h
show query pane
2 / / l
show candidate pane
c
copy suggested comment
r
toggle reasoning
g i
go to index
?
show this help
esc
close overlays

press ? or esc to close

copied