-
-
--
- GIL Held
+
+
+
+
-
-
--
- GIL Released
+
+
+
-
- ` build.
diff --git a/Misc/NEWS.d/next/Library/2025-12-22-00-00-00.gh-issue-143004.uaf-counter.rst b/Misc/NEWS.d/next/Library/2025-12-22-00-00-00.gh-issue-143004.uaf-counter.rst
new file mode 100644
index 00000000000000..278066e9b706bf
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2025-12-22-00-00-00.gh-issue-143004.uaf-counter.rst
@@ -0,0 +1,2 @@
+Fix a potential use-after-free in :meth:`collections.Counter.update` when user code
+mutates the Counter during an update.
diff --git a/Misc/NEWS.d/next/Library/2025-12-23-17-07-22.gh-issue-143103.LRjXEW.rst b/Misc/NEWS.d/next/Library/2025-12-23-17-07-22.gh-issue-143103.LRjXEW.rst
new file mode 100644
index 00000000000000..b00c03707ca352
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2025-12-23-17-07-22.gh-issue-143103.LRjXEW.rst
@@ -0,0 +1 @@
+Add padding support to :func:`base64.z85encode` via the ``pad`` parameter.
diff --git a/Misc/NEWS.d/next/Library/2025-12-24-14-18-52.gh-issue-143145.eXLw8D.rst b/Misc/NEWS.d/next/Library/2025-12-24-14-18-52.gh-issue-143145.eXLw8D.rst
new file mode 100644
index 00000000000000..2aff1090b1812f
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2025-12-24-14-18-52.gh-issue-143145.eXLw8D.rst
@@ -0,0 +1 @@
+Fixed a possible reference leak in ctypes when constructing results with multiple output parameters on error.
diff --git a/Misc/NEWS.d/next/Library/2025-12-25-08-58-55.gh-issue-142164.XrFztf.rst b/Misc/NEWS.d/next/Library/2025-12-25-08-58-55.gh-issue-142164.XrFztf.rst
new file mode 100644
index 00000000000000..e75270b9e94c03
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2025-12-25-08-58-55.gh-issue-142164.XrFztf.rst
@@ -0,0 +1 @@
+Fix the ctypes bitfield overflow error message to report the correct offset and size calculation.
diff --git a/Modules/_collectionsmodule.c b/Modules/_collectionsmodule.c
index 3b14a21fa8428e..45ca63e6d7c77f 100644
--- a/Modules/_collectionsmodule.c
+++ b/Modules/_collectionsmodule.c
@@ -2577,7 +2577,12 @@ _collections__count_elements_impl(PyObject *module, PyObject *mapping,
if (_PyDict_SetItem_KnownHash(mapping, key, one, hash) < 0)
goto done;
} else {
+ /* oldval is a borrowed reference. Keep it alive across
+ PyNumber_Add(), which can execute arbitrary user code and
+ mutate (or even clear) the underlying dict. */
+ Py_INCREF(oldval);
newval = PyNumber_Add(oldval, one);
+ Py_DECREF(oldval);
if (newval == NULL)
goto done;
if (_PyDict_SetItem_KnownHash(mapping, key, newval, hash) < 0)
diff --git a/Modules/_ctypes/_ctypes.c b/Modules/_ctypes/_ctypes.c
index 774ac71ce9ec56..563e95a762599b 100644
--- a/Modules/_ctypes/_ctypes.c
+++ b/Modules/_ctypes/_ctypes.c
@@ -4557,6 +4557,7 @@ _build_result(PyObject *result, PyObject *callargs,
v = PyTuple_GET_ITEM(callargs, i);
v = PyObject_CallMethodNoArgs(v, &_Py_ID(__ctypes_from_outparam__));
if (v == NULL || numretvals == 1) {
+ Py_XDECREF(tup);
Py_DECREF(callargs);
return v;
}
diff --git a/Modules/_ctypes/cfield.c b/Modules/_ctypes/cfield.c
index 547e2471a1cbc0..4ebca0e0b3db0a 100644
--- a/Modules/_ctypes/cfield.c
+++ b/Modules/_ctypes/cfield.c
@@ -160,8 +160,8 @@ PyCField_new_impl(PyTypeObject *type, PyObject *name, PyObject *proto,
if ((bitfield_size + bit_offset) > byte_size * 8) {
PyErr_Format(
PyExc_ValueError,
- "bit field %R overflows its type (%zd + %zd >= %zd)",
- name, bit_offset, byte_size*8);
+ "bit field %R overflows its type (%zd + %zd > %zd)",
+ name, bit_offset, bitfield_size, byte_size * 8);
goto error;
}
}
diff --git a/Python/gc_free_threading.c b/Python/gc_free_threading.c
index 04b9b8f3f85603..51261cea0cfe2c 100644
--- a/Python/gc_free_threading.c
+++ b/Python/gc_free_threading.c
@@ -906,7 +906,11 @@ gc_visit_thread_stacks_mark_alive(PyInterpreterState *interp, gc_mark_args_t *ar
static void
queue_untracked_obj_decref(PyObject *op, struct collection_state *state)
{
- if (!_PyObject_GC_IS_TRACKED(op)) {
+ assert(Py_REFCNT(op) == 0);
+ // gh-142975: We have to treat frozen objects as untracked in this function
+ // or else they might be picked up in a future collection, which breaks the
+ // assumption that all incoming objects have a non-zero reference count.
+ if (!_PyObject_GC_IS_TRACKED(op) || gc_is_frozen(op)) {
// GC objects with zero refcount are handled subsequently by the
// GC as if they were cyclic trash, but we have to handle dead
// non-GC objects here. Add one to the refcount so that we can
--
- Waiting GIL
+
+
+
-
-
diff --git a/Lib/profiling/sampling/_heatmap_assets/heatmap.css b/Lib/profiling/sampling/_heatmap_assets/heatmap.css
index 9999cd6760fd49..8f7f034ba7e596 100644
--- a/Lib/profiling/sampling/_heatmap_assets/heatmap.css
+++ b/Lib/profiling/sampling/_heatmap_assets/heatmap.css
@@ -69,12 +69,10 @@
overflow: hidden;
}
-.stat-card:nth-child(1) { --i: 0; --card-color: 55, 118, 171; }
-.stat-card:nth-child(2) { --i: 1; --card-color: 40, 167, 69; }
-.stat-card:nth-child(3) { --i: 2; --card-color: 255, 193, 7; }
-.stat-card:nth-child(4) { --i: 3; --card-color: 111, 66, 193; }
-.stat-card:nth-child(5) { --i: 4; --card-color: 220, 53, 69; }
-.stat-card:nth-child(6) { --i: 5; --card-color: 23, 162, 184; }
+.stat-card:nth-child(1) { --i: 0; --card-color: var(--card-blue); }
+.stat-card:nth-child(2) { --i: 1; --card-color: var(--card-green); }
+.stat-card:nth-child(3) { --i: 2; --card-color: var(--card-yellow); }
+.stat-card:nth-child(4) { --i: 3; --card-color: var(--card-purple); }
.stat-card:hover {
border-color: rgba(var(--card-color), 0.6);
@@ -159,8 +157,8 @@
overflow: hidden;
}
-.rate-card:nth-child(5) { animation-delay: 0.32s; --rate-color: 220, 53, 69; }
-.rate-card:nth-child(6) { animation-delay: 0.40s; --rate-color: 255, 152, 0; }
+.rate-card:nth-child(5) { animation-delay: 0.32s; --rate-color: var(--card-red); }
+.rate-card:nth-child(6) { animation-delay: 0.40s; --rate-color: var(--card-orange); }
.rate-card:hover {
border-color: rgba(var(--rate-color), 0.5);
diff --git a/Lib/profiling/sampling/_shared_assets/base.css b/Lib/profiling/sampling/_shared_assets/base.css
index cb59a0f77c5b63..2164f3f3aa13c7 100644
--- a/Lib/profiling/sampling/_shared_assets/base.css
+++ b/Lib/profiling/sampling/_shared_assets/base.css
@@ -100,6 +100,14 @@
/* Heatmap span highlighting colors */
--span-hot-base: 255, 100, 50;
--span-cold-base: 150, 150, 150;
+
+ /* Summary card colors - optimized for 4.5:1 contrast on light bg */
+ --card-blue: 44, 102, 149;
+ --card-green: 26, 116, 49;
+ --card-yellow: 134, 100, 4;
+ --card-purple: 102, 57, 166;
+ --card-red: 180, 40, 50;
+ --card-orange: 166, 90, 0;
}
/* Dark theme */
@@ -162,6 +170,14 @@
/* Heatmap span highlighting colors - dark theme */
--span-hot-base: 255, 107, 53;
--span-cold-base: 189, 189, 189;
+
+ /* Summary card colors - optimized for 4.5:1 contrast on dark bg */
+ --card-blue: 88, 166, 255;
+ --card-green: 63, 185, 80;
+ --card-yellow: 210, 153, 34;
+ --card-purple: 163, 113, 247;
+ --card-red: 248, 113, 113;
+ --card-orange: 251, 146, 60;
}
/* --------------------------------------------------------------------------
diff --git a/Lib/profiling/sampling/cli.py b/Lib/profiling/sampling/cli.py
index 10341c1570ceca..dd6431a0322bc7 100644
--- a/Lib/profiling/sampling/cli.py
+++ b/Lib/profiling/sampling/cli.py
@@ -120,8 +120,8 @@ def _build_child_profiler_args(args):
# Sampling options
hz = MICROSECONDS_PER_SECOND // args.sample_interval_usec
child_args.extend(["-r", str(hz)])
- child_args.extend(["-d", str(args.duration)])
-
+ if args.duration is not None:
+ child_args.extend(["-d", str(args.duration)])
if args.all_threads:
child_args.append("-a")
if args.realtime_stats:
@@ -356,9 +356,9 @@ def _add_sampling_options(parser):
"-d",
"--duration",
type=int,
- default=10,
+ default=None,
metavar="SECONDS",
- help="Sampling duration",
+ help="Sampling duration (default: run to completion)",
)
sampling_group.add_argument(
"-a",
@@ -562,7 +562,7 @@ def _create_collector(format_type, sample_interval_usec, skip_idle, opcodes=Fals
if format_type == "binary":
if output_file is None:
raise ValueError("Binary format requires an output file")
- return collector_class(output_file, interval, skip_idle=skip_idle,
+ return collector_class(output_file, sample_interval_usec, skip_idle=skip_idle,
compression=compression)
# Gecko format never skips idle (it needs both GIL and CPU data)
@@ -643,11 +643,11 @@ def _validate_args(args, parser):
return
# Warn about blocking mode with aggressive sampling intervals
- if args.blocking and args.interval < 100:
+ if args.blocking and args.sample_interval_usec < 100:
print(
- f"Warning: --blocking with a {args.interval} µs interval will stop all threads "
- f"{1_000_000 // args.interval} times per second. "
- "Consider using --interval 1000 or higher to reduce overhead.",
+ f"Warning: --blocking with a {args.sample_interval_usec} µs interval will stop all threads "
+ f"{1_000_000 // args.sample_interval_usec} times per second. "
+ "Consider using --sampling-rate 1khz or lower to reduce overhead.",
file=sys.stderr
)
@@ -1107,7 +1107,7 @@ def _handle_live_run(args):
if process.poll() is None:
process.terminate()
try:
- process.wait(timeout=_PROCESS_KILL_TIMEOUT)
+ process.wait(timeout=_PROCESS_KILL_TIMEOUT_SEC)
except subprocess.TimeoutExpired:
process.kill()
process.wait()
diff --git a/Lib/profiling/sampling/sample.py b/Lib/profiling/sampling/sample.py
index 2fe022c85b0b31..5525bffdf5747d 100644
--- a/Lib/profiling/sampling/sample.py
+++ b/Lib/profiling/sampling/sample.py
@@ -76,18 +76,18 @@ def _new_unwinder(self, native, gc, opcodes, skip_non_matching_threads):
)
return unwinder
- def sample(self, collector, duration_sec=10, *, async_aware=False):
+ def sample(self, collector, duration_sec=None, *, async_aware=False):
sample_interval_sec = self.sample_interval_usec / 1_000_000
- running_time = 0
num_samples = 0
errors = 0
interrupted = False
+ running_time_sec = 0
start_time = next_time = time.perf_counter()
last_sample_time = start_time
realtime_update_interval = 1.0 # Update every second
last_realtime_update = start_time
try:
- while running_time < duration_sec:
+ while duration_sec is None or running_time_sec < duration_sec:
# Check if live collector wants to stop
if hasattr(collector, 'running') and not collector.running:
break
@@ -104,7 +104,7 @@ def sample(self, collector, duration_sec=10, *, async_aware=False):
stack_frames = self.unwinder.get_stack_trace()
collector.collect(stack_frames)
except ProcessLookupError as e:
- duration_sec = current_time - start_time
+ running_time_sec = current_time - start_time
break
except (RuntimeError, UnicodeDecodeError, MemoryError, OSError):
collector.collect_failed_sample()
@@ -135,25 +135,25 @@ def sample(self, collector, duration_sec=10, *, async_aware=False):
num_samples += 1
next_time += sample_interval_sec
- running_time = time.perf_counter() - start_time
+ running_time_sec = time.perf_counter() - start_time
except KeyboardInterrupt:
interrupted = True
- running_time = time.perf_counter() - start_time
+ running_time_sec = time.perf_counter() - start_time
print("Interrupted by user.")
# Clear real-time stats line if it was being displayed
if self.realtime_stats and len(self.sample_intervals) > 0:
print() # Add newline after real-time stats
- sample_rate = num_samples / running_time if running_time > 0 else 0
+ sample_rate = num_samples / running_time_sec if running_time_sec > 0 else 0
error_rate = (errors / num_samples) * 100 if num_samples > 0 else 0
- expected_samples = int(duration_sec / sample_interval_sec)
+ expected_samples = int(running_time_sec / sample_interval_sec)
missed_samples = (expected_samples - num_samples) / expected_samples * 100 if expected_samples > 0 else 0
# Don't print stats for live mode (curses is handling display)
is_live_mode = LiveStatsCollector is not None and isinstance(collector, LiveStatsCollector)
if not is_live_mode:
- print(f"Captured {num_samples:n} samples in {fmt(running_time, 2)} seconds")
+ print(f"Captured {num_samples:n} samples in {fmt(running_time_sec, 2)} seconds")
print(f"Sample rate: {fmt(sample_rate, 2)} samples/sec")
print(f"Error rate: {fmt(error_rate, 2)}")
@@ -166,7 +166,7 @@ def sample(self, collector, duration_sec=10, *, async_aware=False):
# Pass stats to flamegraph collector if it's the right type
if hasattr(collector, 'set_stats'):
- collector.set_stats(self.sample_interval_usec, running_time, sample_rate, error_rate, missed_samples, mode=self.mode)
+ collector.set_stats(self.sample_interval_usec, running_time_sec, sample_rate, error_rate, missed_samples, mode=self.mode)
if num_samples < expected_samples and not is_live_mode and not interrupted:
print(
@@ -363,7 +363,7 @@ def sample(
pid,
collector,
*,
- duration_sec=10,
+ duration_sec=None,
all_threads=False,
realtime_stats=False,
mode=PROFILING_MODE_WALL,
@@ -378,7 +378,8 @@ def sample(
Args:
pid: Process ID to sample
collector: Collector instance to use for gathering samples
- duration_sec: How long to sample for (seconds)
+ duration_sec: How long to sample for (seconds), or None to run until
+ the process exits or interrupted
all_threads: Whether to sample all threads
realtime_stats: Whether to print real-time sampling statistics
mode: Profiling mode - WALL (all samples), CPU (only when on CPU),
@@ -427,7 +428,7 @@ def sample_live(
pid,
collector,
*,
- duration_sec=10,
+ duration_sec=None,
all_threads=False,
realtime_stats=False,
mode=PROFILING_MODE_WALL,
diff --git a/Lib/test/test_base64.py b/Lib/test/test_base64.py
index ac3f09405457df..288caf663e8321 100644
--- a/Lib/test/test_base64.py
+++ b/Lib/test/test_base64.py
@@ -665,6 +665,7 @@ def test_z85encode(self):
tests = {
b'': b'',
+ b'\x86\x4F\xD2\x6F\xB5\x59\xF7\x5B': b'HelloWorld',
b'www.python.org': b'CxXl-AcVLsz/dgCA+t',
bytes(range(255)): b"""009c61o!#m2NH?C3>iWS5d]J*6CRx17-skh9337x"""
b"""ar.{NbQB=+c[cR@eg&FcfFLssg=mfIi5%2YjuU>)kTv.7l}6Nnnj=AD"""
@@ -840,6 +841,21 @@ def test_b85_padding(self):
eq(base64.b85decode(b'czAet'), b"xxxx")
eq(base64.b85decode(b'czAetcmMzZ'), b"xxxxx\x00\x00\x00")
+ def test_z85_padding(self):
+ eq = self.assertEqual
+
+ eq(base64.z85encode(b"x", pad=True), b'CMmZz')
+ eq(base64.z85encode(b"xx", pad=True), b'CZ6h*')
+ eq(base64.z85encode(b"xxx", pad=True), b'CZaDk')
+ eq(base64.z85encode(b"xxxx", pad=True), b'CZaET')
+ eq(base64.z85encode(b"xxxxx", pad=True), b'CZaETCMmZz')
+
+ eq(base64.z85decode(b'CMmZz'), b"x\x00\x00\x00")
+ eq(base64.z85decode(b'CZ6h*'), b"xx\x00\x00")
+ eq(base64.z85decode(b'CZaDk'), b"xxx\x00")
+ eq(base64.z85decode(b'CZaET'), b"xxxx")
+ eq(base64.z85decode(b'CZaETCMmZz'), b"xxxxx\x00\x00\x00")
+
def test_a85decode_errors(self):
illegal = (set(range(32)) | set(range(118, 256))) - set(b' \t\n\r\v')
for c in illegal:
diff --git a/Lib/test/test_collections.py b/Lib/test/test_collections.py
index 22595239252814..fad639b20a1801 100644
--- a/Lib/test/test_collections.py
+++ b/Lib/test/test_collections.py
@@ -2135,6 +2135,19 @@ def test_basics(self):
self.assertEqual(c.setdefault('e', 5), 5)
self.assertEqual(c['e'], 5)
+ def test_update_reentrant_add_clears_counter(self):
+ c = Counter()
+ key = object()
+
+ class Evil(int):
+ def __add__(self, other):
+ c.clear()
+ return NotImplemented
+
+ c[key] = Evil()
+ c.update([key])
+ self.assertEqual(c[key], 1)
+
def test_init(self):
self.assertEqual(list(Counter(self=42).items()), [('self', 42)])
self.assertEqual(list(Counter(iterable=42).items()), [('iterable', 42)])
diff --git a/Lib/test/test_ctypes/test_struct_fields.py b/Lib/test/test_ctypes/test_struct_fields.py
index b50bbcbb65c423..dc26e26d8a9fb1 100644
--- a/Lib/test/test_ctypes/test_struct_fields.py
+++ b/Lib/test/test_ctypes/test_struct_fields.py
@@ -130,6 +130,21 @@ class S(Structure):
self.check_struct(S)
self.assertEqual(S.largeField.bit_size, size * 8)
+ def test_bitfield_overflow_error_message(self):
+ with self.assertRaisesRegex(
+ ValueError,
+ r"bit field 'x' overflows its type \(2 \+ 7 > 8\)",
+ ):
+ CField(
+ name="x",
+ type=c_byte,
+ byte_size=1,
+ byte_offset=0,
+ index=0,
+ _internal_use=True,
+ bit_size=7,
+ bit_offset=2,
+ )
# __set__ and __get__ should raise a TypeError in case their self
# argument is not a ctype instance.
diff --git a/Lib/test/test_free_threading/test_gc.py b/Lib/test/test_free_threading/test_gc.py
index 3b83e0431efa6b..8b45b6e2150c28 100644
--- a/Lib/test/test_free_threading/test_gc.py
+++ b/Lib/test/test_free_threading/test_gc.py
@@ -62,6 +62,38 @@ def mutator_thread():
with threading_helper.start_threads(gcs + mutators):
pass
+ def test_freeze_object_in_brc_queue(self):
+ # GH-142975: Freezing objects in the BRC queue could result in some
+ # objects having a zero refcount without being deallocated.
+
+ class Weird:
+ # We need a destructor to trigger the check for object resurrection
+ def __del__(self):
+ pass
+
+ # This is owned by the main thread, so the subthread will have to increment
+ # this object's reference count.
+ weird = Weird()
+
+ def evil():
+ gc.freeze()
+
+ # Decrement the reference count from this thread, which will trigger the
+ # slow path during resurrection and add our weird object to the BRC queue.
+ nonlocal weird
+ del weird
+
+ # Collection will merge the object's reference count and make it zero.
+ gc.collect()
+
+ # Unfreeze the object, making it visible to the GC.
+ gc.unfreeze()
+ gc.collect()
+
+ thread = Thread(target=evil)
+ thread.start()
+ thread.join()
+
if __name__ == "__main__":
unittest.main()
diff --git a/Misc/ACKS b/Misc/ACKS
index a14089a39cce82..bb6b6bde822a4e 100644
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -418,6 +418,7 @@ Lisandro Dalcin
Darren Dale
Andrew Dalke
Lars Damerow
+Hauke Dämpfling
Evan Dandrea
Eric Daniel
Scott David Daniels
diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2025-12-24-13-44-24.gh-issue-142975.8C4vIP.rst b/Misc/NEWS.d/next/Core_and_Builtins/2025-12-24-13-44-24.gh-issue-142975.8C4vIP.rst
new file mode 100644
index 00000000000000..9d7f57ee60aa47
--- /dev/null
+++ b/Misc/NEWS.d/next/Core_and_Builtins/2025-12-24-13-44-24.gh-issue-142975.8C4vIP.rst
@@ -0,0 +1,2 @@
+Fix crash after unfreezing all objects tracked by the garbage collector on
+the :term:`free threaded --
- GC
+
+
+
-
-
--
- Exception
+
+
+