Bug report
Bug description:
import types
def f():
raise ValueError("x")
c = f.__code__.replace(co_linetable=b'\xf0\xff\xff\xff')
g = types.FunctionType(c, {})
try:
g()
except ValueError:
import traceback; traceback.print_exc()```
==694==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50600006125d at pc 0x5652f25e30b4 bp 0x7ffc879b5840 sp 0x7ffc879b5838
READ of size 1 at 0x50600006125d thread T0
#0 0x5652f25e30b3 in read_byte /src/Objects/codeobject.c:1094:12
#1 0x5652f25e30b3 in read_varint /src/Objects/codeobject.c:1104:16
#2 0x5652f25d3bcc in advance_with_locations /src/Objects/codeobject.c:1180:42
#3 0x5652f25d6597 in positionsiter_next /src/Objects/codeobject.c:1460:9
#4 0x5652f2eade74 in islice_next /src/./Modules/itertoolsmodule.c:1828:16
#5 0x5652f2a57f57 in builtin_next /src/Python/bltinmodule.c:1550:11
#6 0x5652f2a7d446 in _PyEval_EvalFrameDefault /src/Python/generated_cases.c.h:1174:23
#7 0x5652f25b6888 in _PyObject_VectorcallDictTstate /src/Objects/call.c:146:15
#8 0x5652f25bab7d in _PyObject_Call_Prepend /src/Objects/call.c:504:24
#9 0x5652f282aab5 in slot_tp_init /src/Objects/typeobject.c:9844:15
#10 0x5652f280cc1a in type_call /src/Objects/typeobject.c:2008:19
#11 0x5652f25b6e73 in _PyObject_MakeTpCall /src/Objects/call.c:242:18
#12 0x5652f2a7fc60 in _PyEval_EvalFrameDefault /src/Python/generated_cases.c.h:1509:19
#13 0x5652f2a61751 in PyEval_EvalCode /src/Python/ceval.c:604:21
#14 0x5652f2d0190d in run_eval_code_obj /src/Python/pythonrun.c:1412:9
#15 0x5652f2cfc2d7 in run_mod /src/Python/pythonrun.c:1520:19
#16 0x5652f2cfc2d7 in _PyRun_File /src/Python/pythonrun.c:1325:15
#17 0x5652f2cfa564 in _PyRun_SimpleFile /src/Python/pythonrun.c:535:15
#18 0x5652f2cf9bea in _PyRun_AnyFile /src/Python/pythonrun.c:80:18
#19 0x5652f2da492c in pymain_run_file_obj /src/Modules/main.c:439:24
#20 0x5652f2da492c in pymain_run_file /src/Modules/main.c:460:20
#21 0x5652f2da29df in pymain_run_python /src/Modules/main.c:749:21
#22 0x5652f2da29df in Py_RunMain /src/Modules/main.c:834:5
#23 0x5652f2da3a4e in pymain_main /src/Modules/main.c:864:12
#24 0x5652f2da3ccb in Py_BytesMain /src/Modules/main.c:888:12
#25 0x7f73a036f1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
#26 0x7f73a036f28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
#27 0x5652f20ee0e4 in _start (/src/python+0x8a50e4) (BuildId: 3b43aba34b3fa4d8f78d45ed989d4376001e9216)
0x50600006125d is located 0 bytes after 61-byte region [0x506000061220,0x50600006125d)
allocated by thread T0 here:
#0 0x5652f2189350 in realloc (/src/python+0x940350) (BuildId: 3b43aba34b3fa4d8f78d45ed989d4376001e9216)
#1 0x5652f27a4db1 in _PyMem_DebugRawRealloc /src/Objects/obmalloc.c:2915:20
#2 0x5652f259f47b in _PyBytes_Resize /src/Objects/bytesobject.c:3213:9
#3 0x5652f258db01 in _PyBytesWriter_Finish /src/Objects/bytesobject.c:3640:21
#4 0x5652f259511c in _PyBytes_DecodeEscape2 /src/Objects/bytesobject.c:1181:12
#5 0x5652f25239d6 in decode_bytes_with_escapes /src/Parser/string_parser.c:213:24
#6 0x5652f21f16f6 in _PyPegen_constant_from_string /src/Parser/action_helpers.c:1436:19
#7 0x5652f2312cae in string_rule /src/Parser/parser.c:16414:20
#8 0x5652f2312cae in _tmp_254_rule /src/Parser/parser.c:40960:27
#9 0x5652f2312cae in _loop1_114_rule /src/Parser/parser.c:32565:29
#10 0x5652f2312cae in strings_rule /src/Parser/parser.c:16466:34
#11 0x5652f227c664 in atom_rule /src/Parser/parser.c:14862:28
#12 0x5652f2271476 in primary_raw /src/Parser/parser.c:14500:25
#13 0x5652f2271476 in primary_rule /src/Parser/parser.c:14298:22
#14 0x5652f226ddff in await_primary_rule /src/Parser/parser.c:14252:28
#15 0x5652f226b7e2 in power_rule /src/Parser/parser.c:14128:18
#16 0x5652f2266482 in factor_rule /src/Parser/parser.c:14078:26
#17 0x5652f2261d88 in term_raw /src/Parser/parser.c:13919:27
#18 0x5652f225f998 in term_rule /src/Parser/parser.c:13662:22
#19 0x5652f2258d5c in sum_raw /src/Parser/parser.c:13615:25
#20 0x5652f2258d5c in sum_rule /src/Parser/parser.c:13494:22
#21 0x5652f22556f8 in shift_expr_raw /src/Parser/parser.c:13454:24
#22 0x5652f22556f8 in shift_expr_rule /src/Parser/parser.c:13314:22
#23 0x5652f2252be9 in bitwise_and_raw /src/Parser/parser.c:13274:31
#24 0x5652f2252be9 in bitwise_and_rule /src/Parser/parser.c:13192:22
#25 0x5652f22507d9 in bitwise_xor_raw /src/Parser/parser.c:13152:32
#26 0x5652f22507d9 in bitwise_xor_rule /src/Parser/parser.c:13070:22
#27 0x5652f2248639 in bitwise_or_raw /src/Parser/parser.c:13030:32
#28 0x5652f2248639 in bitwise_or_rule /src/Parser/parser.c:12948:22
#29 0x5652f22b816f in comparison_rule /src/Parser/parser.c:12188:18
#30 0x5652f22b64df in inversion_rule /src/Parser/parser.c:12139:31
#31 0x5652f22b1d2e in conjunction_rule /src/Parser/parser.c:12016:18
#32 0x5652f228d2de in disjunction_rule /src/Parser/parser.c:11928:18
#33 0x5652f224146b in expression_rule /src/Parser/parser.c:11216:18
#34 0x5652f22f2855 in kwarg_or_starred_rule /src/Parser/parser.c:17941:18
#35 0x5652f22e780d in _gather_126_rule /src/Parser/parser.c:33345:21
#36 0x5652f22e780d in kwargs_rule /src/Parser/parser.c:17715:18
#37 0x5652f22dcfa0 in args_rule /src/Parser/parser.c:17658:18
#38 0x5652f22775b2 in arguments_rule /src/Parser/parser.c:17544:18
#39 0x5652f22a24e3 in t_primary_raw /src/Parser/parser.c:19136:18
#40 0x5652f22a24e3 in t_primary_rule /src/Parser/parser.c:18963:22
SUMMARY: AddressSanitizer: heap-buffer-overflow /src/Objects/codeobject.c:1094:12 in read_byte
Shadow bytes around the buggy address:
0x506000060f80: fd fd fd fd fd fd fd fa fa fa fa fa 00 00 00 00
0x506000061000: 00 00 00 06 fa fa fa fa fd fd fd fd fd fd fd fa
0x506000061080: fa fa fa fa 00 00 00 00 00 00 00 04 fa fa fa fa
0x506000061100: 00 00 00 00 00 00 00 06 fa fa fa fa 00 00 00 00
0x506000061180: 00 00 00 04 fa fa fa fa 00 00 00 00 00 00 00 00
=>0x506000061200: fa fa fa fa 00 00 00 00 00 00 00[05]fa fa fa fa
0x506000061280: fd fd fd fd fd fd fd fa fa fa fa fa 00 00 00 00
0x506000061300: 00 00 00 06 fa fa fa fa 00 00 00 00 00 00 00 04
0x506000061380: fa fa fa fa 00 00 00 00 00 00 00 07 fa fa fa fa
0x506000061400: 00 00 00 00 00 00 00 07 fa fa fa fa fd fd fd fd
0x506000061480: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==694==ABORTING
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
Bug report
Bug description: