From 1f2d6ece55319e6016b97f424d264c47b505e88a Mon Sep 17 00:00:00 2001 From: Erik Date: Fri, 4 Sep 2026 11:28:14 +0200 Subject: [PATCH 1/2] Ready ThreadCanary_Type --- src/c/misc_thread_common.h | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/c/misc_thread_common.h b/src/c/misc_thread_common.h index ca12d4d6..2eebb1ac 100644 --- a/src/c/misc_thread_common.h +++ b/src/c/misc_thread_common.h @@ -265,6 +265,13 @@ static PyTypeObject ThreadCanary_Type = { static void init_cffi_tls_zombie(void) { + /* thread_canary objects are created with PyObject_New(&ThreadCanary_Type); + the type must be readied so it has a valid metatype (ob_type). Otherwise + introspection of a canary from another module dereferences a NULL metatype + and crashes. */ + if (PyType_Ready(&ThreadCanary_Type) < 0) + return; /* error set; PyInit__cffi_backend checks PyErr_Occurred() */ + cffi_zombie_head.zombie_next = &cffi_zombie_head; cffi_zombie_head.zombie_prev = &cffi_zombie_head; cffi_zombie_lock = PyThread_allocate_lock(); From 17ed304a2e7366afc06164a17a1668ee5a6364c9 Mon Sep 17 00:00:00 2001 From: Erik Date: Fri, 4 Sep 2026 14:49:49 +0200 Subject: [PATCH 2/2] Move initialization --- src/c/misc_thread_common.h | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/src/c/misc_thread_common.h b/src/c/misc_thread_common.h index 2eebb1ac..d8d81824 100644 --- a/src/c/misc_thread_common.h +++ b/src/c/misc_thread_common.h @@ -204,6 +204,10 @@ thread_canary_register(PyThreadState *tstate) if (tdict == NULL) goto ignore_error; + /* Give ThreadCanary_Type a valid metatype before instantiating it. */ + if (PyType_Ready(&ThreadCanary_Type) < 0) + goto ignore_error; + canary = PyObject_New(ThreadCanaryObj, &ThreadCanary_Type); //fprintf(stderr, "thread_canary_register(%p): tstate=%p tls=%p\n", canary, tstate, tls); if (canary == NULL) @@ -265,13 +269,6 @@ static PyTypeObject ThreadCanary_Type = { static void init_cffi_tls_zombie(void) { - /* thread_canary objects are created with PyObject_New(&ThreadCanary_Type); - the type must be readied so it has a valid metatype (ob_type). Otherwise - introspection of a canary from another module dereferences a NULL metatype - and crashes. */ - if (PyType_Ready(&ThreadCanary_Type) < 0) - return; /* error set; PyInit__cffi_backend checks PyErr_Occurred() */ - cffi_zombie_head.zombie_next = &cffi_zombie_head; cffi_zombie_head.zombie_prev = &cffi_zombie_head; cffi_zombie_lock = PyThread_allocate_lock();