gh-151830: Raise ValueError instead of SystemError for invalid code objects in marshal.loads()

Author: tonghuaroot

Lib/test/test_marshal.py

@@ -4,6 +4,7 @@
 import array
 import io
 import marshal
+import struct
 import sys
 import unittest
 import os
@@ -140,6 +141,27 @@ def test_different_filenames(self):
         self.assertEqual(co1.co_filename, "f1")
         self.assertEqual(co2.co_filename, "f2")
 
+    def test_inconsistent_code_object(self):
+        # len(localsplusnames) must equal len(localspluskinds); marshal data that
+        # breaks this must raise ValueError, not a leaked SystemError (gh-151830).
+        co = compile("def f(a, b):\n x = a\n", "<test>", "exec").co_consts[0]
+        n = len(co.co_varnames) + len(co.co_cellvars) + len(co.co_freevars)
+        blob = marshal.dumps(co)
+        # Find the localspluskinds record: the TYPE_STRING ('s') whose payload
+        # is exactly n bytes long (one kind byte per localsplus name).
+        for off in range(len(blob) - 5):
+            if blob[off] == ord('s'):
+                if struct.unpack_from('<i', blob, off + 1)[0] == n:
+                    kinds = blob[off + 5:off + 5 + n]
+                    break
+        else:
+            self.fail("could not locate localspluskinds in marshal data")
+        # Rewrite it with one fewer kind byte than there are names.
+        corrupt = (blob[:off] + b's' + struct.pack('<i', n - 1)
+                   + kinds[:n - 1] + blob[off + 5 + n:])
+        with self.assertRaises(ValueError):
+            marshal.loads(corrupt)
+
     def test_no_allow_code(self):
         data = {'a': [({0},)]}
         dump = marshal.dumps(data, allow_code=False)

Misc/NEWS.d/next/Library/2026-06-21-11-46-23.gh-issue-151830.qvOe1f.rst

@@ -0,0 +1,3 @@
+Fixed :func:`marshal.loads` raising :exc:`SystemError` instead of
+:exc:`ValueError` for serialized data containing a code object with
+inconsistent internal fields.

Python/marshal.c

@@ -1670,6 +1670,10 @@ r_object(RFILE *p)
             };
 
             if (_PyCode_Validate(&con) < 0) {
+                if (PyErr_ExceptionMatches(PyExc_SystemError)) {
+                    PyErr_SetString(PyExc_ValueError,
+                        "bad marshal data (invalid code object)");
+                }
                 goto code_error;
             }