devdanzin/deque_copy_oom.md

Created March 18, 2026 10:06

Star (0) You must be signed in to star a gist
Fork (0) You must be signed in to fork a gist

Select an option

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/devdanzin/c0e661ad36a12581333740414e20098e.js"></script>
Save devdanzin/c0e661ad36a12581333740414e20098e to your computer and use it in GitHub Desktop.

Download ZIP

_collectionsmodule.c: deque.copy() ref corruption on OOM

Raw

deque_copy_oom.md

_collectionsmodule.c: deque.copy() ref corruption on OOM

Summary

Py_NewRef(item) passed inline during deque_copy. If append to new deque fails (OOM at block boundary), the ref is orphaned → dealloc corruption.

Reproducer

import _testcapi
from collections import deque

for n in range(1, 80):
    d = deque(range(200))
    _testcapi.set_nomemory(n, 0)
    try:
        d2 = d.copy()
        _testcapi.remove_mem_hooks()
        break
    except MemoryError:
        _testcapi.remove_mem_hooks()
    except:
        _testcapi.remove_mem_hooks()
# Fatal: _Py_Dealloc: Deallocator of type 'collections.deque' cleared

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment