SIGSEGV in TextIOWrapper.readline() after seek() with cookie containing negative chars_to_skip

[marckwei]

Crash report

What happened?

import io, sys

COOKIE_VALUE = (100 << (12 * 8)) | (0x80 << (19 * 8))

data = b"Hello World!" * 100
raw = io.BytesIO(data)
buf = io.BufferedReader(raw)
tio = io.TextIOWrapper(buf, encoding='utf-8')

tio.read(20)
tio.seek(COOKIE_VALUE)
tio.readline()

sys.exit(0)

CPython versions tested on:

3.16

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.16.0a0 (tags/v3.15.0b1-959-gd0714388278:d0714388278, Jul 13 2026, 20:32:55) [GCC 12.3.0] Linux x86_64, GCC 12.3.0

Linked PRs

• gh-153662: Fix crash when calling io.TextIOWrapper.seek() with malformed cookie #153667

[marckwei]

Segmentation fault (core dumped)

[ByteFlowing1337]

The docstring of io.TextIOWrapper.seek explicitly says:

'cookie' must be a number returned by tell().

Though, I think it's worth fixing, and my PR is on the way :)

[picnixz]

The docstring of io.TextIOWrapper.seek explicitly says:

Such docs don't apply when this results in a segfault in general. It's totally possible to make it crash by mistake (unlike when playing with code.__replace__ or other magical stuff). Here, you could get some integer from the user, mess your arithmetic somehow, and end up with a crash (thinking you actually passed the value of tell()). So this is a legitimate bug.