René's URL Explorer Experiment

Title: gh-151763: Fix NULL deref in `os._path_normpath()` by zainnadeem786 · Pull Request #151779 · python/cpython · GitHub

Open Graph Title: gh-151763: Fix NULL deref in `os._path_normpath()` by zainnadeem786 · Pull Request #151779 · python/cpython

X Title: gh-151763: Fix NULL deref in `os._path_normpath()` by zainnadeem786 · Pull Request #151779 · python/cpython

Description: Summary This PR addresses OOM-0028 from gh-151763. It fixes a NULL dereference in os__path_normpath_impl() when memory allocation fails while normalizing a bytes path. Issue os__path_normpath_impl() builds a Unicode result using either PyUnicode_FromOrdinal() or PyUnicode_FromWideChar(). For bytes input, the function then converts that Unicode result back to bytes using PyUnicode_EncodeFSDefault(). Before this change, the result of PyUnicode_FromWideChar() was not checked before the bytes-path encoding branch. Under memory pressure, PyUnicode_FromWideChar() can return NULL with a pending MemoryError. The existing code could then pass that NULL value into PyUnicode_EncodeFSDefault(), causing a crash. Fix Add an explicit NULL check immediately after creating result and before the bytes-path encoding branch. if (result == NULL) { return NULL; } This preserves the pending MemoryError and prevents PyUnicode_EncodeFSDefault() from receiving a NULL object. Validation I validated this using a CPython debug build on Windows: PCbuild\build.bat -p x64 -c Debug Then I used _testcapi.set_nomemory() to inject allocation failures while calling: os.path.normpath(b"a\\..\\b\\c") Before the fix With the NULL guard removed, allocation index 2 crashed: IDX 2 RC 3221225477 3221225477 is 0xC0000005, Windows STATUS_ACCESS_VIOLATION. After the fix With the NULL guard restored, the same allocation index returned a clean MemoryError instead of crashing: IDX 2 RC 10 MEMORYERROR This confirms that the failing OOM path now propagates the allocation failure instead of dereferencing NULL. Tests Focused ntpath tests passed: PCbuild\amd64\python_d.exe -m unittest -v ` test.test_ntpath.TestNtpath.test_normpath ` test.test_ntpath.TestNtpath.test_normpath_invalid_paths ` test.test_ntpath.NtCommonTest.test_normpath_issue5827 ` test.test_ntpath.NtCommonTest.test_normpath_issue106242 Result: Ran 4 tests in 0.009s OK I also checked the patch with: git diff --check -- Modules/posixmodule.c No regression test is included in this PR. The OOM reproducer depends on allocation-failure injection and allocation indexes that can be build-sensitive. The fix itself is a minimal local NULL guard. Addresses OOM-0028 from gh-151763.

Open Graph Description: Summary This PR addresses OOM-0028 from gh-151763. It fixes a NULL dereference in os__path_normpath_impl() when memory allocation fails while normalizing a bytes path. Issue os__path_normpath_impl(...

X Description: Summary This PR addresses OOM-0028 from gh-151763. It fixes a NULL dereference in os__path_normpath_impl() when memory allocation fails while normalizing a bytes path. Issue os__path_normpath_impl(...

Opengraph URL: https://github.com/python/cpython/pull/151779

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width