Skip to content

Segfault / heap corruption when parsing bare & inside template parameter values (reproducible with PYTHONMALLOC=debug) #352

@hakan-persson

Description

@hakan-persson

Version: mwparserfromhell 0.7.2, Python 3.12, Linux x86_64

Minimal reproducer:

import mwparserfromhell
mwparserfromhell.parse("{{T|p=a & b}}")

Run with:

PYTHONMALLOC=debug python reproducer.py

Observed: Immediate segfault with guard-byte corruption (0x00 instead of 0xfd):

Debug memory block at address p=0x...: API '!'
    The 7 pad bytes at p-7 are not all FORBIDDENBYTE (0xfd):
        at p-7: 0x00 *** OUCH
        ...
Fatal Python error: Segmentation fault
  File ".../mwparserfromhell/parser/__init__.py", line 84 in parse

Expected: Either a successful parse result or a Python exception — no memory corruption.

Notes:

  • The crash is immediate and 100% reproducible with PYTHONMALLOC=debug, which debugpy enables automatically when launching under VS Code
  • Without the debug allocator, the same corrupt write lands in unguarded memory and the process continues — no visible crash, but the heap is silently corrupted
  • The trigger is a bare & (unencoded ampersand) as content inside a template parameter value; & does not trigger it

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions