← index #18166Issue #1672
Off-topic · high · value 0.086
QUERY · ISSUE

uctypes.bytearray_at() accepts negative address and segfaults on write

openby MaksimFengopened 2025-09-29updated 2026-03-20
bugproposed-close

Port, board and/or hardware

Unix port

MicroPython version

MicroPython v1.27.0-preview.107.gd1607598f on 2025-09-09; linux [GCC 14.2.0] version

Reproduction

try:
    import uctypes
except ImportError:
    print("SKIP missing uctypes")
else:
    try:
        ba = uctypes.bytearray_at(-9223372036854775808, 4)  # -2**63
        ba[0] = 1  # write to the mapped memory
        print('should not reach here')
    except Exception as e:
        print("EXC %s" % type(e).__name__)

Expected behaviour

A Python-level exception instead of process crash, e.g.:

  • ValueError/OverflowError for negative address; or

  • OSError if the address is not accessible.

At minimum, uctypes.bytearray_at() should reject negative addresses on 64-bit builds rather than silently converting them to huge unsigned pointers.

Observed behaviour

Program received signal SIGSEGV, Segmentation fault.
#0  mp_binary_set_val_array_from_int(typecode=0x1, p=0x8000000000000000, index=0x0, val=0x1)
#1  mp_binary_set_val_array(...)
#2  array_subscr(...)
#3  mp_obj_subscr(...)
#4  mp_execute_bytecode(...)

Additional Information

No, I've provided everything above.

Code of Conduct

Yes, I agree

CANDIDATE · ISSUE

unix: passing in a negative heap size causes a segfault

closedby dhylandsopened 2015-12-02updated 2022-06-25
port-unix

If you call the unix version of micropython with a negative heapsize, then it segfaults:

532 >./micropython -X heapsize=-1M
Segmentation fault (core dumped)

The fundamental problem is that the heapsize parsing code considers negative heapsizes to be valid and will attempt to malloc a negative number of bytes for the heap.

Keyboard

j / / n
next pair
k / / p
previous pair
1 / / h
show query pane
2 / / l
show candidate pane
c
copy suggested comment
r
toggle reasoning
g i
go to index
?
show this help
esc
close overlays

press ? or esc to close

copied