segfault caused by unchecked PyUnicode_AsUTF8 in `_interpreters` module

[stestagg]

Crash report

What happened?

> python -c 'import _interpreters; _interpreters.new_config(gil="\\ud800")'
fish: Job 1, 'python -c 'import _interpreters…' terminated by signal SIGSEGV (Address boundary error)

interpconfig.c _config_dict_copy_str

cpython/Python/interpconfig.c

Line 136 in e8158d1

strncpy(buf, PyUnicode_AsUTF8(item), bufsize-1);

does an unchecked PyUnicode_AsUTF8 which triggers a failure if the gil value contains a unicode lone surrogate.

LLDB trace

> lldb ./python.exe -- -c 'import _interpreters; _interpreters.new_config(gil="\\ud800")'
(lldb) target create "./python.exe"
Current executable set to '~/src/tp/cpython/python.exe' (arm64).
(lldb) settings set -- target.run-args  "-c" "import _interpreters; _interpreters.new_config(gil=\"\\ud800\")"
(lldb) run
Process 16834 launched: '~/src/tp/cpython/python.exe' (arm64)
Process 16834 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
       frame #0: 0x000000019c4a1cb8 libsystem_platform.dylib`_platform_strncpy + 32
libsystem_platform.dylib`_platform_strncpy:
->  0x19c4a1cb8 <+32>: ldr    q0, [x11]


python.exe │ EXC_BAD_ACCESS (code=1, address=0x0)

(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
   * frame #0: 0x000000019c4a1cb8 libsystem_platform.dylib`_platform_strncpy + 32
     frame #1: 0x000000010029e784 python.exe`_config_dict_copy_str(dict=0x00000001055d7b90, name="gil", buf="", bufsize=20) at interpconfig.c:136:5 [opt]
     frame #2: 0x000000010029e2e0 python.exe`interp_config_from_dict(origdict=0x00000001055d7a10, config=0x000000016fdfd51c, missing_allowed=true) at interpconfig.c:188:9 [opt]
     frame #3: 0x000000010029e498 python.exe`_PyInterpreterConfig_UpdateFromDict(config=0x000000016fdfd51c, dict=0x00000001055d7a10) at interpconfig.c:243:9 [opt]
     frame #4: 0x0000000100a4882c _interpreters.cpython-316d-darwin.so`interp_new_config(self=0x000000010563b770, args=0x000000010062a618, kwds=0x00000001055d7a10) at _interpretersmodule.c:822:13 [opt]
     frame #5: 0x000000010010d878 python.exe`cfunction_call(func=0x00000001055fac90, args=0x000000010062a618, kwargs=0x00000001055d7a10) at methodobject.c:564:18 [opt]
     frame #6: 0x0000000100098df0 python.exe`_PyObject_MakeTpCall(tstate=0x0000000100649cf8, callable=0x00000001055fac90, args=0x000000016fdfd680, nargs=0, keywords=0x000000010556d180) at call.c:242:18 [opt]
     frame #7: 0x0000000100098a80 python.exe`_PyObject_VectorcallTstate(tstate=<unavailable>, callable=<unavailable>, args=<unavailable>, nargsf=<unavailable>, kwnames=<unavailable>) at pycore_call.h:142:16 [opt] [artificial]
     frame #8: 0x00000001000998dc python.exe`PyObject_Vectorcall(callable=<unavailable>, args=<unavailable>, nargsf=<unavailable>, kwnames=<unavailable>) at call.c:327:12 [opt] [artificial]
     frame #9: 0x0000000100213bd4 python.exe`_Py_VectorCallInstrumentation_StackRefSteal(callable=(bits = 4385123472), arguments=0x0000000100a28080, total_args=1, kwnames=(bits = 4384543105), call_instrumentation=false, frame=0x0000000100a28020, this_instr=0x00000001055ec7f0, tstate=0x0000000100649cf8) at ceval.c:768:11 [opt]
     frame #10: 0x000000010021dd58 python.exe`_PyEval_EvalFrameDefault(tstate=<unavailable>, frame=0x0000000100a28020, throwflag=<unavailable>) at generated_cases.c.h:3474:35 [opt]
     frame #11: 0x00000001002134bc python.exe`_PyEval_EvalFrame(tstate=0x0000000100649cf8, frame=0x0000000100a28020, throwflag=0) at pycore_ceval.h:122:16 [opt] [inlined]
     frame #12: 0x00000001002134ac python.exe`_PyEval_Vector(tstate=0x0000000100649cf8, func=<unavailable>, locals=0x00000001055d79b0, args=<unavailable>, argcount=0, kwnames=0x0000000000000000) at ceval.c:2172:12 [opt]
     frame #13: 0x0000000100213220 python.exe`PyEval_EvalCode(co=0x00000001055ec700, globals=0x00000001055d79b0, locals=0x00000001055d79b0) at ceval.c:679:21 [opt]
     frame #14: 0x00000001002e12bc python.exe`run_eval_code_obj(tstate=0x0000000100649cf8, co=0x00000001055ec700, globals=0x00000001055d79b0, locals=0x00000001055d79b0) at pythonrun.c:1406:12 [opt]
     frame #15: 0x00000001002e0dd4 python.exe`run_mod(mod=<unavailable>, filename=0x00000001055ea340, globals=<unavailable>, locals=0x00000001055d79b0, flags=<unavailable>, arena=<unavailable>, interactive_src=<unavailable>, generate_new_source=<unavailable>) at pythonrun.c:1509:19 [opt]
     frame #16: 0x00000001002de904 python.exe`_PyRun_String(str="import _interpreters; _interpreters.new_config(gil=\"\\ud800\")\n", name=0x00000001055ea340, start=257, globals=0x00000001055d79b0, locals=0x00000001055d79b0, flags=0x000000016fdfea20, generate_new_source=0) at pythonrun.c:1292:15 [opt]
     frame #17: 0x00000001002de720 python.exe`_PyRun_SimpleString(command="import _interpreters; _interpreters.new_config(gil=\"\\ud800\")\n", name=0x00000001055ea340, flags=0x000000016fdfea20) at pythonrun.c:590:21 [opt]
     frame #18: 0x0000000100311198 python.exe`pymain_run_command(command=<unavailable>) at main.c:308:18 [opt] [inlined]
     frame #19: 0x0000000100311074 python.exe`pymain_run_python(exitcode=0x000000016fdfe9dc) at main.c:795:21 [opt] [inlined]
     frame #20: 0x0000000100310c54 python.exe`Py_RunMain at main.c:891:5 [opt]
     frame #21: 0x0000000100311590 python.exe`pymain_main(args=0x000000016fdfed00) at main.c:921:12 [opt]
     frame #22: 0x00000001003115e0 python.exe`Py_BytesMain(argc=3, argv=0x000000016fdff3d0) at main.c:945:12 [opt]
     frame #23: 0x000000019c0c3e88 dyld`start + 6688

CPython versions tested on:

3.14

Operating systems tested on:

macOS

Output from running 'python -VV' on the command line:

Python 3.16.0a0 (heads/main:20e6c2fc7c1, Aug 19 2026, 16:27:32) [Clang 21.0.0 (clang-2100.3.27.1)]

Linked PRs

• gh-156117: Fix crash on non-UTF-8 gil in interpreter config #156129