Port, board and hardware
Unix port on Linux ARM64.
MicroPython version
MicroPython a129b2fba1 on 2026-10-10; linux [GCC 14.2.0] version (a129b2fba1a3348088c94d0462eef16d20874dea)
Summary
List index and slice operations convert user objects to integers before using cached list state. A conversion callback can clear the list, leaving stale storage or bounds.
Build: VARIANT=coverage with the repository's official ASan flags: -fsanitize=address --param asan-use-after-return=0 -DMP_ASAN=1.
Reproduction
list.index continues after the start index conversion clears the list
# Trigger mp_seq_index_obj using list.index(start) where __int__ clears the list.
l = [object() for _ in range(8)]
class Boom:
def __int__(self):
l.clear()
return 0
l.index(None, Boom())Observed: SUMMARY: AddressSanitizer: SEGV ../../py/obj.c:233 in mp_obj_equal_not_equal
Complete ASan output
AddressSanitizer:DEADLYSIGNAL
=================================================================
==40==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0xaaaabab4fbc4 bp 0xffffea46fdd0 sp 0xffffea46fdd0 T0)
==40==The signal is caused by a READ memory access.
==40==Hint: address points to the zero page.
#0 0xaaaabab4fbc4 in mp_obj_equal_not_equal ../../py/obj.c:233
#1 0xaaaabab5057c in mp_obj_equal ../../py/obj.c:303
#2 0xaaaabab902f8 in mp_seq_index_obj ../../py/sequence.c:197
#3 0xaaaabab67478 in list_index ../../py/objlist.c:375
#4 0xaaaabab608c0 in fun_builtin_var_call ../../py/objfun.c:123
#5 0xaaaabab40618 in mp_call_function_n_kw ../../py/runtime.c:719
#6 0xaaaabab40fbc in mp_call_method_n_kw ../../py/runtime.c:735
#7 0xaaaababa78f4 in mp_execute_bytecode ../../py/vm.c:1069
#8 0xaaaabab60c64 in fun_bc_call ../../py/objfun.c:294
#9 0xaaaabab40618 in mp_call_function_n_kw ../../py/runtime.c:719
#10 0xaaaabab44720 in mp_call_function_0 ../../py/runtime.c:693
#11 0xaaaabacca60c in parse_compile_execute ../../shared/runtime/pyexec.c:137
#12 0xaaaabaccb774 in pyexec_file ../../shared/runtime/pyexec.c:739
#13 0xaaaabacc03f0 in do_file /src/ports/unix/main.c:269
#14 0xaaaabacc1a18 in main_ /src/ports/unix/main.c:692
#15 0xaaaabacc2000 in main /src/ports/unix/main.c:452
#16 0xffffa6662258 (/lib/aarch64-linux-gnu/libc.so.6+0x22258) (BuildId: 4c1eca4527d1163b2dde55860b69f270158febb4)
#17 0xffffa6662338 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x22338) (BuildId: 4c1eca4527d1163b2dde55860b69f270158febb4)
#18 0xaaaabaafccac in _start (/workspace/work/micropython-current/ports/unix/build-asan-linux-official/micropython+0x19ccac) (BuildId: d745232daadafece431463287d3aa5e506209b85)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ../../py/obj.c:233 in mp_obj_equal_not_equal
==40==ABORTING
Slice deletion performs memmove after index conversion clears the list
l = [1]
class Boom:
def __int__(self):
l.clear()
return 0
del l[Boom():]Observed: SUMMARY: AddressSanitizer: negative-size-param ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:98 in memmove
Complete ASan output
=================================================================
==46==ERROR: AddressSanitizer: negative-size-param: (size=-8)
#0 0xffffb08d817c in memmove ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:98
#1 0xaaaaba178f88 in list_subscr ../../py/objlist.c:198
#2 0xaaaaba160640 in mp_obj_subscr ../../py/obj.c:575
#3 0xaaaaba1ba8f4 in mp_execute_bytecode ../../py/vm.c:503
#4 0xaaaaba170c64 in fun_bc_call ../../py/objfun.c:294
#5 0xaaaaba150618 in mp_call_function_n_kw ../../py/runtime.c:719
#6 0xaaaaba154720 in mp_call_function_0 ../../py/runtime.c:693
#7 0xaaaaba2da60c in parse_compile_execute ../../shared/runtime/pyexec.c:137
#8 0xaaaaba2db774 in pyexec_file ../../shared/runtime/pyexec.c:739
#9 0xaaaaba2d03f0 in do_file /src/ports/unix/main.c:269
#10 0xaaaaba2d1a18 in main_ /src/ports/unix/main.c:692
#11 0xaaaaba2d2000 in main /src/ports/unix/main.c:452
#12 0xffffb0262258 (/lib/aarch64-linux-gnu/libc.so.6+0x22258) (BuildId: 4c1eca4527d1163b2dde55860b69f270158febb4)
#13 0xffffb0262338 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x22338) (BuildId: 4c1eca4527d1163b2dde55860b69f270158febb4)
#14 0xaaaaba10ccac in _start (/workspace/work/micropython-current/ports/unix/build-asan-linux-official/micropython+0x19ccac) (BuildId: d745232daadafece431463287d3aa5e506209b85)
0xffffb0681da8 is located 9640 bytes inside of 524288-byte region [0xffffb067f800,0xffffb06ff800)
allocated by thread T0 here:
#0 0xffffb08da400 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0xaaaaba2d0a3c in main_ /src/ports/unix/main.c:481
#2 0xaaaaba2d2000 in main /src/ports/unix/main.c:452
#3 0xffffb0262258 (/lib/aarch64-linux-gnu/libc.so.6+0x22258) (BuildId: 4c1eca4527d1163b2dde55860b69f270158febb4)
#4 0xffffb0262338 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x22338) (BuildId: 4c1eca4527d1163b2dde55860b69f270158febb4)
#5 0xaaaaba10ccac in _start (/workspace/work/micropython-current/ports/unix/build-asan-linux-official/micropython+0x19ccac) (BuildId: d745232daadafece431463287d3aa5e506209b85)
SUMMARY: AddressSanitizer: negative-size-param ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:98 in memmove
==46==ABORTING
Expected behaviour
The operation should complete safely or raise a Python exception without terminating the interpreter.
Observed behaviour
Each reproducer terminates the interpreter under AddressSanitizer in 3/3 runs.
Additional information
No exploitability claim is intended; these are interpreter robustness failures reachable from Python code.
Tracking references: MicroPython-12, MicroPython-14.
Port, board and hardware
Unix port on Linux ARM64.
MicroPython version
MicroPython a129b2fba1 on 2026-10-10; linux [GCC 14.2.0] version(a129b2fba1a3348088c94d0462eef16d20874dea)Summary
List index and slice operations convert user objects to integers before using cached list state. A conversion callback can clear the list, leaving stale storage or bounds.
Build:
VARIANT=coveragewith the repository's official ASan flags:-fsanitize=address --param asan-use-after-return=0 -DMP_ASAN=1.Reproduction
list.indexcontinues after the start index conversion clears the listObserved:
SUMMARY: AddressSanitizer: SEGV ../../py/obj.c:233 in mp_obj_equal_not_equalComplete ASan output
Slice deletion performs
memmoveafter index conversion clears the listObserved:
SUMMARY: AddressSanitizer: negative-size-param ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:98 in memmoveComplete ASan output
Expected behaviour
The operation should complete safely or raise a Python exception without terminating the interpreter.
Observed behaviour
Each reproducer terminates the interpreter under AddressSanitizer in 3/3 runs.
Additional information
No exploitability claim is intended; these are interpreter robustness failures reachable from Python code.
Tracking references: MicroPython-12, MicroPython-14.