Skip to content

gh-131181: Fix possible NULL pointer dereference in Modules/_ctypes/_ctypes.c - #131186

Closed
dyupina wants to merge 1 commit into
python:3.12from
dyupina:fix-issue-131181
Closed

dyupina wants to merge 1 commit into
python:3.12from
dyupina:fix-issue-131181

Conversation

@dyupina

@dyupina dyupina commented Mar 13, 2025 •

Copy link
Copy Markdown

In the PyCData_NewGetBuffer() (file Modules/_ctypes/_ctypes.c), the PyObject_stgdict() is called, which may return NULL.
Its result is assigned to dict, then dict is dereferenced (view->format = dict->format ? dict->format : "B";).
If dict is NULL, a null pointer dereference will occur, so a check for NULL need to be added.

Similarly, in the PyCData_reduce() (file Modules/_ctypes/_ctypes.c) PyObject_stgdict(myself) may return NULL, so need to check result to prevent null pointer dereferencing.

Commit dcaf33a (Author: @encukou) fixes this problems, but it is very large and probably difficult to backport, so I suggest adding assert(); before the dereference.

This needs to be added to branches 3.1 - 3.12.
Found by Linux Verification Center (linuxtesting.org) with SVACE.

@ghost

ghost commented Mar 13, 2025

Copy link
Copy Markdown

The following commit authors need to sign the Contributor License Agreement:

Click the button to sign:
CLA not signed

@bedevere-app

bedevere-app Bot commented Mar 13, 2025

Copy link
Copy Markdown

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant