René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Undefined Behavior in _PyUnicodeWriter_WriteASCIIString: NULL pointer passed to memcpy when len is 0","articleBody":"# Bug report\n\n### Bug description:\n\nThe function `_PyUnicodeWriter_WriteASCIIString` in `Objects/unicodeobject.c` (or `Objects/unicode_writer.c` in some versions) contains a potential Undefined Behavior. When `len` is 0 and `ascii` is `NULL`, it calls `memcpy` with a `NULL` source pointer.\n\nAccording to the C standard, passing `NULL` to `memcpy` is undefined even if the count is zero.\n\n### Proof of Concept\nClang's UndefinedBehaviorSanitizer (UBSan) reports:\n`../Objects/unicode_writer.c:494:36: runtime error: null pointer passed as argument 2, which is declared to never be null`\n\nThis happens in the following block:\n```c\n    case PyUnicode_1BYTE_KIND:\n    {\n        const Py_UCS1 *str = (const Py_UCS1 *)ascii;\n        Py_UCS1 *data = writer-\u003edata;\n        memcpy(data + writer-\u003epos, str, len); // \u003c--- UB if str is NULL and len is 0\n        break;\n    }\n```\n\n### Mitigation\nThe function should return early if `len == 0`. This is a common pattern in CPython to avoid unnecessary work and prevent UB with memory functions.\n\n```c\n    if (len == -1)\n        len = strlen(ascii);\n    if (len == 0)\n        return 0;\n```\n\n### CPython versions tested on:\n\nCPython main branch\n\n### Operating systems tested on:\n\nLinux\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-146201\n* gh-146220\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/ashm-dev","@type":"Person","name":"ashm-dev"},"datePublished":"2026-03-20T09:29:33.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":8},"url":"https://github.com/146196/cpython/issues/146196"}