gh-151895: Fix marshal.loads() crash on dict reference-tracking failure (GH-151896)

https://github.com/python/cpython/commit/5b96d3914767dc71cb21fd3448f5ded4fd85d957
commit: 5b96d3914767dc71cb21fd3448f5ded4fd85d957
branch: main
author: tonghuaroot (童话) <[email protected]>
committer: serhiy-storchaka <[email protected]>
date: 2026-08-16T19:07:02+03:00
summary:

gh-151895: Fix marshal.loads() crash on dict reference-tracking failure (GH-151896)

Loading a reference-tracked dictionary dereferenced a NULL pointer when
the allocation that registers it for back-references failed under low
memory.  It now raises MemoryError, matching the tuple and list paths.

files:
A Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-11-05-56.gh-issue-151895.QQsjUQ.rst
M Python/marshal.c

diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-11-05-56.gh-issue-151895.QQsjUQ.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-11-05-56.gh-issue-151895.QQsjUQ.rst
new file mode 100644
index 00000000000000..e17b340348b06b
--- /dev/null
+++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-11-05-56.gh-issue-151895.QQsjUQ.rst
@@ -0,0 +1,2 @@
+Fixed a crash in :func:`marshal.loads` when an allocation failed while
+loading a reference-tracked dictionary; it now raises :exc:`MemoryError`.
diff --git a/Python/marshal.c b/Python/marshal.c
index 25353f6e689624..603697e9081c59 100644
--- a/Python/marshal.c
+++ b/Python/marshal.c
@@ -1471,6 +1471,9 @@ r_object(RFILE *p)
         }
         if (type == TYPE_DICT) {
             R_REF(v);
+            if (v == NULL) {
+                break;
+            }
         }
         else {
             idx = r_ref_reserve(flag, p);

_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]