From 041da11041486062ef1d073299e99934fc744463 Mon Sep 17 00:00:00 2001
From: Alba Mendez <me@alba.sh>
Date: Fri, 20 Mar 2026 05:58:47 +0100
Subject: [PATCH] do not crash on __delitem__

---
 src/c/_cffi_backend.c             | 5 +++++
 src/c/minibuffer.h                | 5 +++++
 testing/cffi0/test_ffi_backend.py | 8 ++++++++
 3 files changed, 18 insertions(+)

diff --git a/src/c/_cffi_backend.c b/src/c/_cffi_backend.c
index 6087e635..6a2d4957 100644
--- a/src/c/_cffi_backend.c
+++ b/src/c/_cffi_backend.c
@@ -2609,6 +2609,11 @@ cdata_ass_slice(CDataObject *cd, PySliceObject *slice, PyObject *v)
     cdata = cd->c_data + itemsize * bounds[0];
     length = bounds[1];
 
+    if (v == NULL) {
+        PyErr_SetString(PyExc_TypeError,
+                        "'del x[n]' not supported for cdata objects");
+        return -1;
+    }
     if (CData_Check(v)) {
         CTypeDescrObject *ctv = ((CDataObject *)v)->c_type;
         if ((ctv->ct_flags & CT_ARRAY) && (ctv->ct_itemdescr == ct) &&
diff --git a/src/c/minibuffer.h b/src/c/minibuffer.h
index a6d40e4f..89e400fa 100644
--- a/src/c/minibuffer.h
+++ b/src/c/minibuffer.h
@@ -243,6 +243,11 @@ static PyObject *mb_subscript(MiniBufferObj *self, PyObject *item)
 static int
 mb_ass_subscript(MiniBufferObj* self, PyObject* item, PyObject* value)
 {
+    if (value == NULL) {
+        PyErr_SetString(PyExc_TypeError,
+                        "'del x[n]' not supported for buffer objects");
+        return -1;
+    }
     if (PyIndex_Check(item)) {
         Py_ssize_t i = PyNumber_AsSsize_t(item, PyExc_IndexError);
         if (i == -1 && PyErr_Occurred())
diff --git a/testing/cffi0/test_ffi_backend.py b/testing/cffi0/test_ffi_backend.py
index 986f7081..ff75dba6 100644
--- a/testing/cffi0/test_ffi_backend.py
+++ b/testing/cffi0/test_ffi_backend.py
@@ -587,6 +587,14 @@ def test_unpack(self):
         p = ffi.new("int[]", [-123456789])
         assert ffi.unpack(p, 1) == [-123456789]
 
+    def test_delitem_raises(self):
+        ffi = FFI()
+        arr = ffi.new("int[5]")
+        buf = ffi.buffer(arr)
+        for obj in (arr, buf):
+            pytest.raises(TypeError, obj.__delitem__, 0) # del obj[0]
+            pytest.raises(TypeError, obj.__delitem__, slice(1, 3)) # del obj[1:3]
+
     def test_negative_array_size(self):
         ffi = FFI()
         pytest.raises(ValueError, ffi.cast, "int[-5]", 0)