stack-buffer-overflow when parsing `ast.FunctionType` with `mode='func_type'`

[correctmost]

Crash report

What happened?

Python crashes when running this fuzzed code:

import ast

ast.parse(ast.FunctionType(returns=None), mode='func_type')

UBSan and ASan output:

Python/Python-ast.c:18568:55: runtime error: index 3 out of bounds for type 'PyObject *[3]'
Python/Python-ast.c:18568:22: runtime error: load of address 0x7bcfd1981c78 with insufficient space for an object of type 'struct PyObject *'

ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7bcfd1981c78
READ of size 8 at 0x7bcfd1981c78 thread T0
    #0 0x557d1e69fb29 in PyAst_CheckMode Python/Python-ast.c:18568
    #1 0x557d1e69fdda in PyAST_obj2mod Python/Python-ast.c:18591
    #2 0x557d1e70052f in builtin_compile_impl Python/bltinmodule.c:924
    #3 0x557d1e70052f in builtin_compile Python/clinic/bltinmodule.c.h:472
    #4 0x557d1def19a2 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #5 0x557d1def19a2 in PyObject_Vectorcall Objects/call.c:327
    #6 0x557d1e72581e in _Py_VectorCallInstrumentation_StackRefSteal Python/ceval.c:768
    #7 0x557d1e75618d in _PyEval_EvalFrameDefault Python/generated_cases.c.h:3474
    #8 0x557d1e7c5aec in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
    #9 0x557d1e7c5aec in _PyEval_Vector Python/ceval.c:2172
    #10 0x557d1e7c5aec in PyEval_EvalCode Python/ceval.c:679
    #11 0x557d1ea4fce3 in run_mod Python/pythonrun.c:1509
    #12 0x557d1ea50d87 in _PyRun_File Python/pythonrun.c:1332
    #13 0x557d1ea5635e in _PyRun_SimpleFile Python/pythonrun.c:544
    #14 0x557d1ea5ae2c in _PyRun_AnyFile Python/pythonrun.c:92
    #15 0x557d1eb61c21 in pymain_run_file_obj Modules/main.c:478
    #16 0x557d1eb61c21 in pymain_run_file Modules/main.c:494
    #17 0x557d1eb61c21 in pymain_run_python Modules/main.c:804
    #18 0x557d1eb61c21 in Py_RunMain Modules/main.c:891
    #19 0x557d1eb647d2 in pymain_main Modules/main.c:921
    #20 0x557d1eb647d2 in Py_BytesMain Modules/main.c:945

Address 0x7bcfd1981c78 is located in stack of thread T0 at offset 120 in frame
    #0 0x557d1e69f55f in PyAst_CheckMode Python/Python-ast.c:18554

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.16.0a0 (heads/main:26d9b255801, Aug 30 2026, 16:33:09) [GCC 16.2.1 20260810]