Repository navigation
func_get_annotation_dict missing critical section after gh-128714 #159091
Description
Bug report
gh-128714 added @critical_section to the __annotations__ setter and deleter, but the getter (function___annotations___get_impl) and its helper func_get_annotation_dict were not protected.
// NO @critical_section on the getter
static PyObject *
function___annotations___get_impl(PyFunctionObject *self)
{
...
d = func_get_annotation_dict(self); // reads + Py_XSETREF without lock
}
// line ~976 — setter has @critical_section, getter does notfunc_get_annotation_dict (line 539) does an unprotected read of op->func_annotations and a Py_XSETREF into it at line 557. A concurrent setter holds a critical section; the getter does not. This is a read-write race.
Found while auditing CPython with cpython-review-toolkit (maintained by @devdanzin and myself).
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Activity
hetaozdh commentedon Oct 9, 2026
I don't think the getter part of this issue is a real bug. The getter already has the
@critical_sectiontag, and Argument Clinic generates the locking code correctly.However, I tested and found that
PyFunction_GetAnnotations()appears to access the same field without holding the critical section. I'll open a PR to fix that path instead.Merge branch 'main' into pythongh-159091-pyfunction-getannotations