Skip to content

Commit 591365c

Browse files
colorfulapplkumaraditya303erlend-aasland
authored
[3.10] gh-99240: Reset pointer to NULL when the pointed memory is freed in argument parsing (GH-99890) (#100386)
(cherry picked from commit efbb1eb) Co-authored-by: Kumar Aditya <59607654+kumaraditya303@users.noreply.github.com> Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>
1 parent 919045c commit 591365c

File tree

4 files changed

+31
-5
lines changed

4 files changed

+31
-5
lines changed

Lib/test/test_capi/test_getargs.py

+4
Original file line numberDiff line numberDiff line change
@@ -1098,6 +1098,10 @@ def test_Z_hash(self):
10981098
warnings.simplefilter('error', DeprecationWarning)
10991099
self.assertRaises(DeprecationWarning, getargs_Z_hash, 'abc\xe9')
11001100

1101+
def test_gh_99240_clear_args(self):
1102+
from _testcapi import gh_99240_clear_args
1103+
self.assertRaises(TypeError, gh_99240_clear_args, 'a', '\0b')
1104+
11011105

11021106
class Object_TestCase(unittest.TestCase):
11031107
def test_S(self):
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
In argument parsing, after deallocating newly allocated memory, reset its
2+
pointer to NULL.

Modules/_testcapimodule.c

+20
Original file line numberDiff line numberDiff line change
@@ -5671,6 +5671,7 @@ test_fatal_error(PyObject *self, PyObject *args)
56715671
static PyObject *test_buildvalue_issue38913(PyObject *, PyObject *);
56725672
static PyObject *getargs_s_hash_int(PyObject *, PyObject *, PyObject*);
56735673
static PyObject *getargs_s_hash_int2(PyObject *, PyObject *, PyObject*);
5674+
static PyObject *gh_99240_clear_args(PyObject *, PyObject *);
56745675

56755676
static PyMethodDef TestMethods[] = {
56765677
{"raise_exception", raise_exception, METH_VARARGS},
@@ -5784,6 +5785,7 @@ static PyMethodDef TestMethods[] = {
57845785
METH_VARARGS|METH_KEYWORDS},
57855786
{"getargs_s_hash_int2", (PyCFunction)(void(*)(void))getargs_s_hash_int2,
57865787
METH_VARARGS|METH_KEYWORDS},
5788+
{"gh_99240_clear_args", gh_99240_clear_args, METH_VARARGS},
57875789
{"getargs_z", getargs_z, METH_VARARGS},
57885790
{"getargs_z_star", getargs_z_star, METH_VARARGS},
57895791
{"getargs_z_hash", getargs_z_hash, METH_VARARGS},
@@ -7500,3 +7502,21 @@ getargs_s_hash_int2(PyObject *self, PyObject *args, PyObject *kwargs)
75007502
PyBuffer_Release(&buf);
75017503
Py_RETURN_NONE;
75027504
}
7505+
7506+
static PyObject *
7507+
gh_99240_clear_args(PyObject *self, PyObject *args)
7508+
{
7509+
char *a = NULL;
7510+
char *b = NULL;
7511+
7512+
if (!PyArg_ParseTuple(args, "eses", "idna", &a, "idna", &b)) {
7513+
if (a || b) {
7514+
PyErr_Clear();
7515+
PyErr_SetString(PyExc_AssertionError, "Arguments are not cleared.");
7516+
}
7517+
return NULL;
7518+
}
7519+
PyMem_Free(a);
7520+
PyMem_Free(b);
7521+
Py_RETURN_NONE;
7522+
}

Python/getargs.c

+5-5
Original file line numberDiff line numberDiff line change
@@ -201,9 +201,9 @@ _PyArg_VaParse_SizeT(PyObject *args, const char *format, va_list va)
201201
static int
202202
cleanup_ptr(PyObject *self, void *ptr)
203203
{
204-
if (ptr) {
205-
PyMem_Free(ptr);
206-
}
204+
void **pptr = (void **)ptr;
205+
PyMem_Free(*pptr);
206+
*pptr = NULL;
207207
return 0;
208208
}
209209

@@ -1168,7 +1168,7 @@ _Py_COMP_DIAG_POP
11681168
PyErr_NoMemory();
11691169
RETURN_ERR_OCCURRED;
11701170
}
1171-
if (addcleanup(*buffer, freelist, cleanup_ptr)) {
1171+
if (addcleanup(buffer, freelist, cleanup_ptr)) {
11721172
Py_DECREF(s);
11731173
return converterr(
11741174
"(cleanup problem)",
@@ -1214,7 +1214,7 @@ _Py_COMP_DIAG_POP
12141214
PyErr_NoMemory();
12151215
RETURN_ERR_OCCURRED;
12161216
}
1217-
if (addcleanup(*buffer, freelist, cleanup_ptr)) {
1217+
if (addcleanup(buffer, freelist, cleanup_ptr)) {
12181218
Py_DECREF(s);
12191219
return converterr("(cleanup problem)",
12201220
arg, msgbuf, bufsize);

0 commit comments

Comments
 (0)