Segmentation fault when instantiating decimal.SignalDictMixin type

[CharlieZhao95]

Crash report

The following code will causes a segmentation fault:

>>> import decimal
>>> tp = type(decimal.Context().flags)  # SignalDict type
>>> tp()  # Segmentation fault

This code instantiates an object of SignalDict type (inherited from the base class SignalDictMixin) and tries to print the contents of the object (use repr).

The problem is caused by the following C code, where the signaldict_repr function accesses a null pointer.

static int
signaldict_init(PyObject *self, PyObject *args UNUSED, PyObject *kwds UNUSED)
{
    SdFlagAddr(self) = NULL;
    return 0;
}
...
static PyObject *
signaldict_repr(PyObject *self)
{
    ...
    for (cm=signal_map, i=0; cm->name != NULL; cm++, i++) {
        n[i] = cm->fqname;
        // Access NULL pointer here
        b[i] = SdFlags(self)&cm->flag ? "True" : "False";
    }
    ...
}

Your environment

• CPython versions tested on: 3.13.0.0a0, 3.10.2
• Operating system and architecture: Ubuntu 22.04.1 LTS, Windows 11

Linked PRs

• gh-106263: Fix segfault in signaldict_repr #106270
• [3.11] gh-106263: Fix segfault in signaldict_repr in _decimal module (#… #107490
• [3.12] gh-106263: Fix segfault in signaldict_repr in _decimal module (#… #107491

[CharlieZhao95]

Note: This problem will not be triggered normally, because we will assign a value to SignalDict in the constructor of decimal.Context(). We usually don't manually construct a SignalDict object.

>>> import decimal
>>> flags = decimal.Context().flags
>>> tp = type(flags)
>>> tp
<class 'abc.SignalDict'>
>>> flags
{<class 'decimal.InvalidOperation'>:False, <class 'decimal.FloatOperation'>:False, <class 'decimal.DivisionByZero'>:False, <class 'decimal.Overflow'>:False, <class 'decimal.Underflow'>:False, <class 'decimal.Subnormal'>:False, <class 'decimal.Inexact'>:False, <class 'decimal.Rounded'>:False, <class 'decimal.Clamped'>:False}

[CharlieZhao95]

The simplest solution is to assign default values to signaldict object in the signaldict_init function. I will propose a fix. :)