Skip to content

ringbuf: Zero-length ringbuf creation allowed, causes crash #17847

@jepler

Description

@jepler

Port, board and/or hardware

unix port, coverage variant, x86_64 linux

MicroPython version

MicroPython v1.26.0-preview.524.g255d74b5a8 on 2025-08-06; linux [GCC 12.2.0] version

Reproduction

Run the following script:

import micropython
rb = micropython.RingIO(bytearray(0))
rb.write(b'\1')

Expected behaviour

An exception is thown on line 2, because a zero-byte ring buffer is nonsense.

Observed behaviour

Division by zero (reported by Linux as SIGFPE) occurs on line 3:

>>> micropython.RingIO(bytearray(0)).write(b'\1')

Program received signal SIGFPE, Arithmetic exception.
0x0000555555605f33 in ringbuf_free (r=0x7ffff7c318a8) at ../../py/ringbuf.h:86
86	    return (r->size + r->iget - r->iput - 1) % r->size;

Additional Information

Found via fuzzing, manually minimized.

Code of Conduct

Yes, I agree

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions