Skip to content

Use of uninitialized pointer in Argument Clinic generated code #97728

@serhiy-storchaka

Description

@serhiy-storchaka
Member

The code generated for the Py_UNICODE converter (and derived converter LPCWSTR) looks like:

const Py_UNICODE *name;
...
if (!_PyArg_ParseXXX(..., name, ...)) {
    goto exit;
}
...
exit:
    PyMem_Free((void *)name);

If parsing fails, PyMem_Free() is called for uninitialized variable.

It is the only converter with non-trivial cleanup which does not have a mandatory initializer.

Activity

serhiy-storchaka

serhiy-storchaka commented on Oct 2, 2022

@serhiy-storchaka
MemberAuthor

Seems that for now it only affects the Windows code.

I have found this bug when tried to use Argument Clinic for OS agnostic code which converts arguments to wchar_t * (in getpath.c).

added a commit that references this issue on Oct 2, 2022
eryksun

eryksun commented on Oct 2, 2022

@eryksun
Contributor

These needs to be fixed if _winapi.CreateJunction() is used as a fallback for os.symlink() when creating a compatibility link such as "bin -> Scripts". More here: #97586 (comment).

added a commit that references this issue on Oct 3, 2022
0ee9619
added 2 commits that reference this issue on Oct 3, 2022
added 2 commits that reference this issue on Oct 3, 2022
added a commit that references this issue on Oct 3, 2022
kumaraditya303

kumaraditya303 commented on Oct 16, 2022

@kumaraditya303
Contributor

Fixed by #97729

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.10only security fixes3.11only security fixes3.12only security fixesOS-windowstopic-argument-clinictype-bugAn unexpected behavior, bug, or errortype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

      Development

      No branches or pull requests

        Participants

        @eryksun@serhiy-storchaka@kumaraditya303

        Issue actions

          Use of uninitialized pointer in Argument Clinic generated code · Issue #97728 · python/cpython