mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-11-01 10:45:30 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 16

[security] bpo-13617: Reject embedded null characters in wchar* strings. (#2302)

Browse source 
Based on patch by Victor Stinner.

Add private C API function _PyUnicode_AsUnicode() which is similar to
PyUnicode_AsUnicode(), but checks for null characters.
This commit is contained in:
Serhiy Storchaka 2017-06-28 08:30:06 +03:00 • committed by GitHub
parent 592eda1233
commit f7eae0adfc
22 changed files with 115 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

18
Modules/posixmodule.c
View file

@ -3757,7 +3757,7 @@ os__getfinalpathname_impl(PyObject *module, PyObject *path)
PyObject *result;
const wchar_t *path_wchar;
path_wchar = PyUnicode_AsUnicode(path);
path_wchar = _PyUnicode_AsUnicode(path);
if (path_wchar == NULL)
return NULL;
@ -7209,7 +7209,7 @@ win_readlink(PyObject *self, PyObject *args, PyObject *kwargs)
))
return NULL;
path = PyUnicode_AsUnicode(po);
path = _PyUnicode_AsUnicode(po);
if (path == NULL)
return NULL;
@ -9002,6 +9002,7 @@ os_putenv_impl(PyObject *module, PyObject *name, PyObject *value)
/*[clinic end generated code: output=d29a567d6b2327d2 input=ba586581c2e6105f]*/
{
const wchar_t *env;
Py_ssize_t size;
/* Search from index 1 because on Windows starting '=' is allowed for
defining hidden environment variables. */
@ -9015,16 +9016,21 @@ os_putenv_impl(PyObject *module, PyObject *name, PyObject *value)
if (unicode == NULL) {
return NULL;
}
if (_MAX_ENV < PyUnicode_GET_LENGTH(unicode)) {
env = PyUnicode_AsUnicodeAndSize(unicode, &size);
if (env == NULL)
goto error;
if (size > _MAX_ENV) {
PyErr_Format(PyExc_ValueError,
"the environment variable is longer than %u characters",
_MAX_ENV);
goto error;
}
env = PyUnicode_AsUnicode(unicode);
if (env == NULL)
if (wcslen(env) != (size_t)size) {
PyErr_SetString(PyExc_ValueError, "embedded null character");
goto error;
}
if (_wputenv(env)) {
posix_error();
goto error;