gh-135075: Make PyObject_SetAttr() fail with NULL value and exception

Doc/c-api/object.rst

@@ -197,6 +197,8 @@ Object Protocol
    in favour of using :c:func:`PyObject_DelAttr`, but there are currently no
    plans to remove it.
 
+   The function must not be called with ``NULL`` *v* and an an exception set.
+
 
 .. c:function:: int PyObject_SetAttrString(PyObject *o, const char *attr_name, PyObject *v)
 
@@ -207,6 +209,8 @@ Object Protocol
    If *v* is ``NULL``, the attribute is deleted, but this feature is
    deprecated in favour of using :c:func:`PyObject_DelAttrString`.
 
+   The function must not be called with ``NULL`` *v* and an an exception set.
+
    The number of different attribute names passed to this function
    should be kept small, usually by using a statically allocated string
    as *attr_name*.

Lib/test/test_capi/test_object.py

@@ -247,5 +247,20 @@ def func(x):
 
         func(object())
 
+    def test_object_setattr_null_exc(self):
+        class Obj:
+            pass
+        obj = Obj()
+
+        obj.attr = 123
+        with self.assertRaises(SystemError):
+            _testcapi.object_setattr_null_exc(obj, 'attr')
+        self.assertTrue(hasattr(obj, 'attr'))
+
+        with self.assertRaises(SystemError):
+            _testcapi.object_setattrstring_null_exc(obj, 'attr')
+        self.assertTrue(hasattr(obj, 'attr'))
+
+
 if __name__ == "__main__":
     unittest.main()

Misc/NEWS.d/next/C_API/2025-07-01-16-22-39.gh-issue-135075.angu3J.rst

@@ -0,0 +1,2 @@
+Make :c:func:`PyObject_SetAttr` and :c:func:`PyObject_SetAttrString` fail if
+called with ``NULL`` value and an exception set. Patch by Victor Stinner.

Modules/_testcapi/object.c

@@ -485,6 +485,41 @@ is_uniquely_referenced(PyObject *self, PyObject *op)
 }
 
 
+static PyObject *
+object_setattr_null_exc(PyObject *self, PyObject *args)
+{
+    PyObject *obj, *name;
+    if (!PyArg_ParseTuple(args, "OO", &obj, &name)) {
+        return NULL;
+    }
+
+    PyErr_SetString(PyExc_ValueError, "error");
+    if (PyObject_SetAttr(obj, name, NULL) < 0) {
+        return NULL;
+    }
+    assert(PyErr_Occurred());
+    return NULL;
+}
+
+
+static PyObject *
+object_setattrstring_null_exc(PyObject *self, PyObject *args)
+{
+    PyObject *obj;
+    const char *name;
+    if (!PyArg_ParseTuple(args, "Os", &obj, &name)) {
+        return NULL;
+    }
+
+    PyErr_SetString(PyExc_ValueError, "error");
+    if (PyObject_SetAttrString(obj, name, NULL) < 0) {
+        return NULL;
+    }
+    assert(PyErr_Occurred());
+    return NULL;
+}
+
+
 static PyMethodDef test_methods[] = {
     {"call_pyobject_print", call_pyobject_print, METH_VARARGS},
     {"pyobject_print_null", pyobject_print_null, METH_VARARGS},
@@ -511,6 +546,8 @@ static PyMethodDef test_methods[] = {
     {"test_py_is_funcs", test_py_is_funcs, METH_NOARGS},
     {"clear_managed_dict", clear_managed_dict, METH_O, NULL},
     {"is_uniquely_referenced", is_uniquely_referenced, METH_O},
+    {"object_setattr_null_exc", object_setattr_null_exc, METH_VARARGS},
+    {"object_setattrstring_null_exc", object_setattrstring_null_exc, METH_VARARGS},
     {NULL},
 };
 

Objects/object.c

@@ -1213,16 +1213,27 @@ PyObject_HasAttrString(PyObject *obj, const char *name)
 int
 PyObject_SetAttrString(PyObject *v, const char *name, PyObject *w)
 {
-    PyObject *s;
-    int res;
+    if (Py_TYPE(v)->tp_setattr != NULL) {
+        PyThreadState *tstate = _PyThreadState_GET();
+        if (w == NULL && _PyErr_Occurred(tstate)) {
+            PyObject *exc = _PyErr_GetRaisedException(tstate);
+            _PyErr_SetString(tstate, PyExc_SystemError,
+                "PyObject_SetAttrString() must not be called with NULL value "
+                "and an exception set");
+            _PyErr_ChainExceptions1Tstate(tstate, exc);
+            return -1;
+        }
 
-    if (Py_TYPE(v)->tp_setattr != NULL)
         return (*Py_TYPE(v)->tp_setattr)(v, (char*)name, w);
-    s = PyUnicode_InternFromString(name);
-    if (s == NULL)
+    }
+
+    PyObject *s = PyUnicode_InternFromString(name);
+    if (s == NULL) {
         return -1;
-    res = PyObject_SetAttr(v, s, w);
-    Py_XDECREF(s);
+    }
+
+    int res = PyObject_SetAttr(v, s, w);
+    Py_DECREF(s);
     return res;
 }
 
@@ -1440,6 +1451,16 @@ PyObject_HasAttr(PyObject *obj, PyObject *name)
 int
 PyObject_SetAttr(PyObject *v, PyObject *name, PyObject *value)
 {
+    PyThreadState *tstate = _PyThreadState_GET();
+    if (value == NULL && _PyErr_Occurred(tstate)) {
+        PyObject *exc = _PyErr_GetRaisedException(tstate);
+        _PyErr_SetString(tstate, PyExc_SystemError,
+            "PyObject_SetAttr() must not be called with NULL value "
+            "and an exception set");
+        _PyErr_ChainExceptions1Tstate(tstate, exc);
+        return -1;
+    }
+
     PyTypeObject *tp = Py_TYPE(v);
     int err;
 
@@ -1451,8 +1472,7 @@ PyObject_SetAttr(PyObject *v, PyObject *name, PyObject *value)
     }
     Py_INCREF(name);
 
-    PyInterpreterState *interp = _PyInterpreterState_GET();
-    _PyUnicode_InternMortal(interp, &name);
+    _PyUnicode_InternMortal(tstate->interp, &name);
     if (tp->tp_setattro != NULL) {
         err = (*tp->tp_setattro)(v, name, value);
         Py_DECREF(name);