Add input validation to _PyImport_LazyImportModuleLevelObject

Author: StanFromIreland

Lib/test/test_import/test_lazy_imports.py

@@ -393,6 +393,15 @@ def test_dunder_lazy_import_used(self):
         import test.test_import.data.lazy_imports.dunder_lazy_import_used
         self.assertIn("test.test_import.data.lazy_imports.basic2", sys.modules)
 
+    def test_dunder_lazy_import_non_string_name(self):
+        """__lazy_import__ should reject non-string name arguments."""
+        with self.assertRaises(TypeError):
+            __lazy_import__(b"")
+        with self.assertRaises(TypeError):
+            __lazy_import__(123)
+        with self.assertRaises(TypeError):
+            __lazy_import__(None)
+
     def test_dunder_lazy_import_builtins(self):
         """__lazy_import__ should use module's __builtins__ for __import__."""
         from test.test_import.data.lazy_imports import dunder_lazy_import_builtins

Misc/NEWS.d/next/Core_and_Builtins/2026-02-21-09-47-45.gh-issue-145058.e-RBw-.rst

@@ -0,0 +1,2 @@
+Fix a crash when :func:`!__lazy_import__` is passed a non-string argument,
+by raising an :exc:`TypeError` instead.

Python/import.c

@@ -4468,6 +4468,20 @@ _PyImport_LazyImportModuleLevelObject(PyThreadState *tstate,
                                       PyObject *globals, PyObject *locals,
                                       PyObject *fromlist, int level)
 {
+    if (name == NULL) {
+        _PyErr_SetString(tstate, PyExc_ValueError, "Empty module name");
+        return NULL;
+    }
+    if (!PyUnicode_Check(name)) {
+        _PyErr_SetString(tstate, PyExc_TypeError,
+                         "module name must be a string");
+        return NULL;
+    }
+    if (level < 0) {
+        _PyErr_SetString(tstate, PyExc_ValueError, "level must be >= 0");
+        return NULL;
+    }
+
     PyObject *abs_name = get_abs_name(tstate, name, globals, level);
     if (abs_name == NULL) {
         return NULL;