gh-115136: Fix possible NULL deref in getpath_joinpath() #115137
Conversation
Check return value of PyMem_Malloc() before passing to memset() Signed-off-by: Artem Chernyshev <artem.chernyshev@red-soft.ru>
|
All commit authors signed the Contributor License Agreement. |
|
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Signed-off-by: Artem Chernyshev <artem.chernyshev@red-soft.ru>
| @@ -0,0 +1 @@ | |||
| Check return value of PyMem_Malloc() before passing to memset() | |||
There was a problem hiding this comment.
Nit: we can use RST markups here. And maybe we should describe we added the check to which part of the codebase.
| Check return value of PyMem_Malloc() before passing to memset() | |
| Check return value of :c:func:`PyMem_Malloc` before passing to :c:func:`memset` | |
| in ``Modules/getpath.c``. |
There was a problem hiding this comment.
Thank you for review, updated entry with your suggestion
There was a problem hiding this comment.
Sorry, I updated the comment after your latest commits. I think we should add a description of which part we add the check to.
There was a problem hiding this comment.
I think there is no need in a NEWS entry. Otherwise LGTM.
There was a problem hiding this comment.
I agree with @Eclips4, The NEWS entry should contain information understendable and useful for common Python user. The common Python user has no idea what is Modules/getpath.c and how this change affects their code. Should they worry? What code they should avoid? What workaround they should use and what workaround is no longer needed?
This bug has no workaround, but it can happen only in very rare circumstances, and may be shadowed by other bugs. So the common user should not worry about it, not more than about other not yet found bugs or about the OOM killer killing their program.
|
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
|
Thanks @dTenebrae for the PR, and @serhiy-storchaka for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11, 3.12. |
…nGH-115137) (cherry picked from commit 9e90313) Co-authored-by: Artem Chernyshev <62871052+dTenebrae@users.noreply.github.com> Signed-off-by: Artem Chernyshev <artem.chernyshev@red-soft.ru>
|
GH-115157 is a backport of this pull request to the 3.12 branch. |
…nGH-115137) (cherry picked from commit 9e90313) Co-authored-by: Artem Chernyshev <62871052+dTenebrae@users.noreply.github.com> Signed-off-by: Artem Chernyshev <artem.chernyshev@red-soft.ru>
|
GH-115158 is a backport of this pull request to the 3.11 branch. |
…nGH-115137) Signed-off-by: Artem Chernyshev <artem.chernyshev@red-soft.ru>
Check return value of PyMem_Malloc() before passing to memset()
getpath_joinpath()#115136