gh-142781: address review comments by refactoring TypeError message, rewriting NEWS and improving unit test

Author: superboy-zjc

Lib/test/test_zoneinfo/test_zoneinfo.py

@@ -1575,33 +1575,37 @@ class EvilZoneInfo(self.klass):
 class CZoneInfoCacheTest(ZoneInfoCacheTest):
     module = c_zoneinfo
 
-    def test_weak_cache_get_type_confusion(self):
-        class EvilCache:
+    def test_inconsistent_weak_cache_get(self):
+        class Cache:
             def get(self, key, default=None):
                 return 1337
 
-        class EvilZoneInfo(self.klass):
+        class ZI(self.klass):
             pass
+        # Must set AFTER class creation to override __init_subclass__
+        ZI._weak_cache = Cache()
 
-        EvilZoneInfo._weak_cache = EvilCache()
-
-        with self.assertRaises(TypeError):
-            EvilZoneInfo("America/Los_Angeles")
+        with self.assertRaises(TypeError) as te:
+            ZI("America/Los_Angeles")
+        # Heap type objects' tp_name should just be the type name, i.e. ZI
+        self.assertEqual(str(te.exception), "expected ZI, got int")
 
-    def test_weak_cache_setdefault_type_confusion(self):
-        class EvilCache:
+    def test_inconsistent_weak_cache_setdefault(self):
+        class Cache:
             def get(self, key, default=None):
                 return default
             def setdefault(self, key, value):
                 return 1337
 
-        class EvilZoneInfo(self.klass):
+        class ZI(self.klass):
             pass
+        # Must set AFTER class creation to override __init_subclass__
+        ZI._weak_cache = Cache()
 
-        EvilZoneInfo._weak_cache = EvilCache()
-
-        with self.assertRaises(TypeError):
-            EvilZoneInfo("America/Los_Angeles")
+        with self.assertRaises(TypeError) as te:
+            ZI("America/Los_Angeles")
+        # Heap type objects' tp_name should just be the type name, i.e. ZI
+        self.assertEqual(str(te.exception), "expected ZI, got int")
 
 class ZoneInfoPickleTest(TzPathUserMixin, ZoneInfoTestBase):
     module = py_zoneinfo

Misc/NEWS.d/next/Library/2025-12-18-00-14-16.gh-issue-142781.gcOeYF.rst

@@ -1,3 +1,2 @@
-Fix a type confusion in zoneinfo where a malicious override of _weak_cache
-in a zoneinfo subclass can cause memory corruption and crash the
-interpreter.
+:mod:`zoneinfo`: fix a crash when instantiating :class:`~zoneinfo.ZoneInfo`
+objects for which the internal class-level cache is inconsistent.

Modules/_zoneinfo.c

@@ -328,9 +328,8 @@ zoneinfo_ZoneInfo_impl(PyTypeObject *type, PyObject *key)
     }
 
     if (instance != Py_None && !PyObject_TypeCheck(instance, type)) {
-        const char *e = "%s._weak_cache.get() returned %s, expected %s";
-        PyErr_Format(PyExc_TypeError, e,
-                     type->tp_name, Py_TYPE(instance)->tp_name, type->tp_name);
+        PyErr_Format(PyExc_TypeError, "expected %s, got %s",
+                     type->tp_name, Py_TYPE(instance)->tp_name);
         Py_DECREF(instance);
         Py_DECREF(weak_cache);
         return NULL;
@@ -353,9 +352,8 @@ zoneinfo_ZoneInfo_impl(PyTypeObject *type, PyObject *key)
         }
 
         if (!PyObject_TypeCheck(instance, type)) {
-            const char *e = "%s._weak_cache.setdefault() returned %s, expected %s";
-            PyErr_Format(PyExc_TypeError, e,
-                         type->tp_name, Py_TYPE(instance)->tp_name, type->tp_name);
+            PyErr_Format(PyExc_TypeError, "expected %s, got %s",
+                         type->tp_name, Py_TYPE(instance)->tp_name);
             Py_DECREF(instance);
             Py_DECREF(weak_cache);
             return NULL;