Possible NULL dereference on calloc() failure in test_pre_initialization_sys_options() (Programs/_testembed.c) · Issue #139146 · python/cpython · GitHub
Skip to content

Possible NULL dereference on calloc() failure in test_pre_initialization_sys_options() (Programs/_testembed.c) #139146

Description

@zeff-ir

Bug report

Bug description:

In test_pre_initialization_sys_options() (Programs/_testembed.c),
the pointers dynamic_once_warnoption and dynamic_xoption allocated via
calloc() are passed to wcsncpy() without NULL checks.

On allocation failure (OOM), this can lead to a NULL dereference.

/* bpo-33042: Ensure embedding apps can predefine sys module options */
static int test_pre_initialization_sys_options(void)
{
    /* We allocate a couple of the options dynamically, and then delete
     * them before calling Py_Initialize. This ensures the interpreter isn't
     * relying on the caller to keep the passed in strings alive.
     */
    const wchar_t *static_warnoption = L"once";
    const wchar_t *static_xoption = L"also_not_an_option=2";
    size_t warnoption_len = wcslen(static_warnoption);
    size_t xoption_len = wcslen(static_xoption);
    wchar_t *dynamic_once_warnoption = \
             (wchar_t *) calloc(warnoption_len+1, sizeof(wchar_t));
    wchar_t *dynamic_xoption = \
             (wchar_t *) calloc(xoption_len+1, sizeof(wchar_t));

    wcsncpy(dynamic_once_warnoption, static_warnoption, warnoption_len+1);
    wcsncpy(dynamic_xoption, static_xoption, xoption_len+1);

Found by Linux Verification Center (linuxtesting.org) with SVACE.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    testsTests in the Lib/test dirtype-bugAn unexpected behavior, bug, or error

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions