[3.13] gh-148157: Check for _PyPegen_add_type_comment_to_arg fail in _PyPegen_name_default_pair (GH-148158) (#148163)

miss-islington · StanFromIreland · web-flow · commit 4dfcdbe22c19 · 2026-04-06T12:13:32.000Z
(cherry picked from commit 1795fcc) Co-authored-by: Stan Ulbrych <stan@python.org>
diff --git a/Lib/test/test_type_comments.py b/Lib/test/test_type_comments.py
@@ -398,6 +398,9 @@ def test_non_utf8_type_comment_with_ignore_cookie(self):
         with self.assertRaises(UnicodeDecodeError):
             _testcapi.Py_CompileStringExFlags(
                 b"a=1 # type: \x80", "<test>", 256, flags)
+        with self.assertRaises(UnicodeDecodeError):
+            _testcapi.Py_CompileStringExFlags(
+                b"def a(f=8, #type: \x80\n\x80", "<test>", 256, flags)
 
     def test_func_type_input(self):
 
diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-04-06-11-15-46.gh-issue-148157.JFnZDn.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-04-06-11-15-46.gh-issue-148157.JFnZDn.rst
@@ -0,0 +1,2 @@
+Fix an unlikely crash when parsing an invalid type comments for function
+parameters. Found by OSS Fuzz in :oss-fuzz:`492782951`.
diff --git a/Parser/action_helpers.c b/Parser/action_helpers.c
@@ -434,6 +434,9 @@ _PyPegen_name_default_pair(Parser *p, arg_ty arg, expr_ty value, Token *tc)
         return NULL;
     }
     a->arg = _PyPegen_add_type_comment_to_arg(p, arg, tc);
+    if (!a->arg) {
+        return NULL;
+    }
     a->value = value;
     return a;
 }

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+Fix an unlikely crash when parsing an invalid type comments for function`
	`2`	+parameters. Found by OSS Fuzz in :oss-fuzz:`492782951`.
Original file line number	Diff line number	Diff line change
`@@ -434,6 +434,9 @@ _PyPegen_name_default_pair(Parser p, arg_ty arg, expr_ty value, Token tc)`
`434`	`434`	`return NULL;`
`435`	`435`	`}`
`436`	`436`	`a->arg = _PyPegen_add_type_comment_to_arg(p, arg, tc);`
	`437`	`+ if (!a->arg) {`
	`438`	`+ return NULL;`
	`439`	`+ }`
`437`	`440`	`a->value = value;`
`438`	`441`	`return a;`
`439`	`442`	`}`