From d267d7236f7dd8e85402ab38d5b3d3ddaca99a82 Mon Sep 17 00:00:00 2001
From: tonghuaroot <tonghuaroot@gmail.com>
Date: Sun, 21 Jun 2026 11:46:50 +0800
Subject: [PATCH 1/3] gh-151830: Raise ValueError instead of SystemError for
 invalid code objects in marshal.loads()

---
 Lib/test/test_marshal.py                      | 22 +++++++++++++++++++
 ...-06-21-11-46-23.gh-issue-151830.qvOe1f.rst |  3 +++
 Python/marshal.c                              |  4 ++++
 3 files changed, 29 insertions(+)
 create mode 100644 Misc/NEWS.d/next/Library/2026-06-21-11-46-23.gh-issue-151830.qvOe1f.rst

diff --git a/Lib/test/test_marshal.py b/Lib/test/test_marshal.py
index 9c4d91c456dc5d..3ed3bcb7f4016c 100644
--- a/Lib/test/test_marshal.py
+++ b/Lib/test/test_marshal.py
@@ -4,6 +4,7 @@
 import array
 import io
 import marshal
+import struct
 import sys
 import unittest
 import os
@@ -140,6 +141,27 @@ def test_different_filenames(self):
         self.assertEqual(co1.co_filename, "f1")
         self.assertEqual(co2.co_filename, "f2")
 
+    def test_inconsistent_code_object(self):
+        # len(localsplusnames) must equal len(localspluskinds); marshal data that
+        # breaks this must raise ValueError, not a leaked SystemError (gh-151830).
+        co = compile("def f(a, b):\n x = a\n", "<test>", "exec").co_consts[0]
+        n = len(co.co_varnames) + len(co.co_cellvars) + len(co.co_freevars)
+        blob = marshal.dumps(co)
+        # Find the localspluskinds record: the TYPE_STRING ('s') whose payload
+        # is exactly n bytes long (one kind byte per localsplus name).
+        for off in range(len(blob) - 5):
+            if blob[off] == ord('s'):
+                if struct.unpack_from('<i', blob, off + 1)[0] == n:
+                    kinds = blob[off + 5:off + 5 + n]
+                    break
+        else:
+            self.fail("could not locate localspluskinds in marshal data")
+        # Rewrite it with one fewer kind byte than there are names.
+        corrupt = (blob[:off] + b's' + struct.pack('<i', n - 1)
+                   + kinds[:n - 1] + blob[off + 5 + n:])
+        with self.assertRaises(ValueError):
+            marshal.loads(corrupt)
+
     def test_no_allow_code(self):
         data = {'a': [({0},)]}
         dump = marshal.dumps(data, allow_code=False)
diff --git a/Misc/NEWS.d/next/Library/2026-06-21-11-46-23.gh-issue-151830.qvOe1f.rst b/Misc/NEWS.d/next/Library/2026-06-21-11-46-23.gh-issue-151830.qvOe1f.rst
new file mode 100644
index 00000000000000..bd127d5acca705
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-06-21-11-46-23.gh-issue-151830.qvOe1f.rst
@@ -0,0 +1,3 @@
+Fixed :func:`marshal.loads` raising :exc:`SystemError` instead of
+:exc:`ValueError` for serialized data containing a code object with
+inconsistent internal fields.
diff --git a/Python/marshal.c b/Python/marshal.c
index 9688d426419c2f..b88af1c522c081 100644
--- a/Python/marshal.c
+++ b/Python/marshal.c
@@ -1670,6 +1670,10 @@ r_object(RFILE *p)
             };
 
             if (_PyCode_Validate(&con) < 0) {
+                if (PyErr_ExceptionMatches(PyExc_SystemError)) {
+                    PyErr_SetString(PyExc_ValueError,
+                        "bad marshal data (invalid code object)");
+                }
                 goto code_error;
             }
 

From 6df07fd7c044f97db5ad2dfc8db70436b2008bba Mon Sep 17 00:00:00 2001
From: tonghuaroot <tonghuaroot@gmail.com>
Date: Sun, 21 Jun 2026 13:21:46 +0800
Subject: [PATCH 2/3] Keep test comment within 79 columns

---
 Lib/test/test_marshal.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Lib/test/test_marshal.py b/Lib/test/test_marshal.py
index 3ed3bcb7f4016c..8fd7acc97b980c 100644
--- a/Lib/test/test_marshal.py
+++ b/Lib/test/test_marshal.py
@@ -142,8 +142,8 @@ def test_different_filenames(self):
         self.assertEqual(co2.co_filename, "f2")
 
     def test_inconsistent_code_object(self):
-        # len(localsplusnames) must equal len(localspluskinds); marshal data that
-        # breaks this must raise ValueError, not a leaked SystemError (gh-151830).
+        # localsplusnames and localspluskinds must have equal length; if
+        # not, marshal must raise ValueError, not SystemError (gh-151830).
         co = compile("def f(a, b):\n x = a\n", "<test>", "exec").co_consts[0]
         n = len(co.co_varnames) + len(co.co_cellvars) + len(co.co_freevars)
         blob = marshal.dumps(co)

From 0d21591483c303edb2e0f37dc4fe9653f5a7bac5 Mon Sep 17 00:00:00 2001
From: tonghuaroot <tonghuaroot@gmail.com>
Date: Sun, 21 Jun 2026 22:33:58 +0800
Subject: [PATCH 3/3] gh-151830: Assert localspluskinds value and use
 assertRaisesRegex in test

---
 Lib/test/test_marshal.py | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/Lib/test/test_marshal.py b/Lib/test/test_marshal.py
index 8fd7acc97b980c..cd53a77866d55c 100644
--- a/Lib/test/test_marshal.py
+++ b/Lib/test/test_marshal.py
@@ -144,22 +144,24 @@ def test_different_filenames(self):
     def test_inconsistent_code_object(self):
         # localsplusnames and localspluskinds must have equal length; if
         # not, marshal must raise ValueError, not SystemError (gh-151830).
-        co = compile("def f(a, b):\n x = a\n", "<test>", "exec").co_consts[0]
+        co = compile("def f():\n a=1;b=2;c=3", "<test>", "exec").co_consts[0]
         n = len(co.co_varnames) + len(co.co_cellvars) + len(co.co_freevars)
         blob = marshal.dumps(co)
         # Find the localspluskinds record: the TYPE_STRING ('s') whose payload
         # is exactly n bytes long (one kind byte per localsplus name).
+        kinds = None
         for off in range(len(blob) - 5):
             if blob[off] == ord('s'):
                 if struct.unpack_from('<i', blob, off + 1)[0] == n:
                     kinds = blob[off + 5:off + 5 + n]
                     break
-        else:
-            self.fail("could not locate localspluskinds in marshal data")
+        # f's locals (a, b, c) are all plain fast locals (CO_FAST_LOCAL).
+        self.assertEqual(kinds, bytes([0x20]) * n)
         # Rewrite it with one fewer kind byte than there are names.
         corrupt = (blob[:off] + b's' + struct.pack('<i', n - 1)
                    + kinds[:n - 1] + blob[off + 5 + n:])
-        with self.assertRaises(ValueError):
+        with self.assertRaisesRegex(
+                ValueError, r'bad marshal data \(invalid code object\)'):
             marshal.loads(corrupt)
 
     def test_no_allow_code(self):