← index #18169Issue #18800
Related · high · value 0.710
QUERY · ISSUE

Viper: ptr8(0)[0] = 1 causes SIGSEGV on unix port

openby MaksimFengopened 2025-09-29updated 2026-03-20
bugproposed-close

Port, board and/or hardware

Unix

MicroPython version

MicroPython v1.27.0-preview.107.gd1607598f on 2025-09-09; linux [GCC 14.2.0] version

Reproduction

try:
    import micropython
except ImportError:
    print("SKIP missing micropython")
else:
    try:
        @micropython.viper
        def poke0():
            p = ptr8(0)
            p[0] = 1
        try:
            poke0()
            print("should not reach here")
        except Exception as e:
            print("EXC", type(e).__name__)
    except AttributeError:
        print("SKIP viper_not_available")


Expected behaviour

it would be helpful if either:

  • Viper rejected obviously invalid addresses like 0 (and perhaps addr + size overflow) with a Python exception in a debug/safe build mode, or
  • The docs explicitly call out that such code will crash the process.

Observed behaviour

The process crashes with SIGSEGV at the generated Viper instruction

[#0] 0x7ffff7fba051 → mov BYTE PTR [rbx], dl
[#1] 0x7ffff7e27f40 → rex.WX sbb rax, QWORD PTR [rax]
[#2] 0x5555555f39e4 → mp_cstack_usage()
[#3] 0x7ffff7e27b60 → rcr ch, 1

Additional Information

No, I've provided everything above.

Code of Conduct

Yes, I agree

CANDIDATE · ISSUE

Micropython Viper error: overwrites call parameter

closedby GitHubsSilverBulletopened 2026-02-10updated 2026-02-16
bug

Port, board and/or hardware

PICO,PICO2,rp2040,rp2350

MicroPython version

MicroPython v1.27.0 on 2025-12-09; Raspberry Pi Pico with RP2040
MicroPython v1.27.0 on 2025-12-09; Raspberry Pi Pico2 with RP2350

Reproduction

#!/micropython
# vim: fileencoding=utf-8: ts=4: sw=4: expandtab:
from uctypes import addressof
from array import array
from sys import implementation

@micropython.viper
def viperfunc(baseadr: ptr32, offset: int) -> int:
    saved_offset: int = offset
    if offset != saved_offset: print('ERROR1')      # offset is OK
    x: int = baseadr[offset]                        # just READING item @ offset messes things up
    if offset != saved_offset: print('ERROR2')      # offset is modified (shouldn't)
    return x

print(implementation)
arr = array('I', (i*10 for i in range(10)))
ofs = 2
print(viperfunc(arr, ofs))
print(viperfunc(addressof(arr), ofs))
# Result:
#   (name='micropython', version=(1, 27, 0, ''), _machine='Raspberry Pi Pico with RP2040', _mpy=4870, _build='RPI_PICO', _thread='unsafe')
#   (name='micropython', version=(1, 27, 0, ''), _machine='Raspberry Pi Pico2 with RP2350', _mpy=7942, _build='RPI_PICO2', _thread='unsafe')
#   ERROR2
#   20
#   ERROR2
#   20

Expected behaviour

Shouldn't print an error at all.

Observed behaviour

Maybe some can have a look at it, but I'm rather sure that this is a problem.
Just reading a value from an array changes the (call parameter) offset.

Additional Information

No, I've provided everything above.

Code of Conduct

Yes, I agree

Keyboard

j / / n
next pair
k / / p
previous pair
1 / / h
show query pane
2 / / l
show candidate pane
c
copy suggested comment
r
toggle reasoning
g i
go to index
?
show this help
esc
close overlays

press ? or esc to close

copied