← index #18168Issue #18166
Related · high · value 1.646
QUERY · ISSUE

Resizing bytearray with active memoryviews corrupts state and segfaults

openby MaksimFengopened 2025-09-29updated 2025-10-20
bug

Port, board and/or hardware

Unix

MicroPython version

MicroPython v1.27.0-preview.107.gd1607598f on 2025-09-09; linux [GCC 14.2.0] version

Reproduction

import gc

ba = bytearray(b"abcdefghij")
views = [memoryview(ba) for _ in range(4)]

ba[:] = ba + b"X"*256   

gc.collect()            

for i, mv in enumerate(views):
    mv[0:1] = b"Y"

Expected behaviour

Attempting to resize a bytearray that has active memoryview exports should raise a Python exception and must not corrupt the VM or crash.

Observed behaviour

The resize succeeds; existing memoryviews retain stale pointers to the old buffer. After gc.collect() (or later operations), the VM state gets corrupted and the process segfaults in unrelated code paths (e.g., during enumerate, inside mp_load_method_maybe).

Additional Information

No, I've provided everything above.

Code of Conduct

Yes, I agree

CANDIDATE · ISSUE

uctypes.bytearray_at() accepts negative address and segfaults on write

openby MaksimFengopened 2025-09-29updated 2026-03-20
bugproposed-close

Port, board and/or hardware

Unix port

MicroPython version

MicroPython v1.27.0-preview.107.gd1607598f on 2025-09-09; linux [GCC 14.2.0] version

Reproduction

try:
    import uctypes
except ImportError:
    print("SKIP missing uctypes")
else:
    try:
        ba = uctypes.bytearray_at(-9223372036854775808, 4)  # -2**63
        ba[0] = 1  # write to the mapped memory
        print('should not reach here')
    except Exception as e:
        print("EXC %s" % type(e).__name__)

Expected behaviour

A Python-level exception instead of process crash, e.g.:

  • ValueError/OverflowError for negative address; or

  • OSError if the address is not accessible.

At minimum, uctypes.bytearray_at() should reject negative addresses on 64-bit builds rather than silently converting them to huge unsigned pointers.

Observed behaviour

Program received signal SIGSEGV, Segmentation fault.
#0  mp_binary_set_val_array_from_int(typecode=0x1, p=0x8000000000000000, index=0x0, val=0x1)
#1  mp_binary_set_val_array(...)
#2  array_subscr(...)
#3  mp_obj_subscr(...)
#4  mp_execute_bytecode(...)

Additional Information

No, I've provided everything above.

Code of Conduct

Yes, I agree

Keyboard

j / / n
next pair
k / / p
previous pair
1 / / h
show query pane
2 / / l
show candidate pane
c
copy suggested comment
r
toggle reasoning
g i
go to index
?
show this help
esc
close overlays

press ? or esc to close

copied