Sitelet https://github.com/python/cpython/issues/97728
Skip to content

Use of uninitialized pointer in Argument Clinic generated code #97728

Description

@serhiy-storchaka

The code generated for the Py_UNICODE converter (and derived converter LPCWSTR) looks like:

const Py_UNICODE *name;
...
if (!_PyArg_ParseXXX(..., name, ...)) {
    goto exit;
}
...
exit:
    PyMem_Free((void *)name);

If parsing fails, PyMem_Free() is called for uninitialized variable.

It is the only converter with non-trivial cleanup which does not have a mandatory initializer.

Activity

  1. serhiy-storchaka commented on Oct 2, 2022

    @serhiy-storchaka
    MemberAuthor

    Seems that for now it only affects the Windows code.

    I have found this bug when tried to use Argument Clinic for OS agnostic code which converts arguments to wchar_t * (in getpath.c).

  2. added a commit that references this issue on Oct 2, 2022
  3. eryksun commented on Oct 2, 2022

    @eryksun
    Contributor

    These needs to be fixed if _winapi.CreateJunction() is used as a fallback for os.symlink() when creating a compatibility link such as "bin -> Scripts". More here: #97586 (comment).

  4. added 5 commits that reference this issue on Oct 3, 2022
  5. added a commit that references this issue on Oct 3, 2022
  6. kumaraditya303 commented on Oct 16, 2022

    @kumaraditya303
    Contributor

    Fixed by #97729

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.10 (EOL)end of life3.11only security fixes3.12only security fixesOS-windowstopic-argument-clinictype-bugAn unexpected behavior, bug, or errortype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions