`SystemError` from `termios.tcsetwinsize`passing `NULL` to `PyLong_AsLong`

devdanzin

Crash report

What happened?

It's possible to raise SystemError from termios.tcsetwinsize by passing a sequence that raises on __getitem__ to it.

Automated diagnosis:

Bug: termios.tcsetwinsize passes NULL to PyLong_AsLong. PySequence_GetItem(winsz, 0) can return NULL (e.g., __getitem__ raises). The result is passed directly to PyLong_AsLong(NULL) which calls PyErr_BadInternalCall(), masking the real error with SystemError.

File: Modules/termios.c, lines 502-510

MRE:

import termios
import os

fd = os.open("/dev/tty", os.O_RDWR | os.O_NOCTTY)

class BadSequence:
    def __len__(self):
        return 2
    def __getitem__(self, idx):
        raise TypeError

termios.tcsetwinsize(fd, BadSequence())

Backtrace:

Traceback (most recent call last):
  File "/home/danzin/crashers/trigger_termios_null_pylong.py", line 23, in <module>
    termios.tcsetwinsize(fd, BadSequence())
    ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
SystemError: Objects/longobject.c:598: bad argument to internal function

Found using cpython-review-toolkit with Claude Opus 4.6, using the /cpython-review-toolkit:explore Modules/termios.c all deep command.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.15.0a7+ (heads/main:e0f7c1097e1, Mar 17 2026, 18:10:52) [Clang 21.1.2 (2ubuntu6)]

Linked PRs

gh-146091: Fix NULL check in termios.tcsetwinsize #146147