Skip to content
Prev Previous commit
Reject embedded null characters in mmap tagname and _winapi file mapp…
…ing names
  • Loading branch information
youknowone committed Feb 23, 2026
commit 7b8bce418dde9100ac4ece16d09c495372fcd7ef
10 changes: 8 additions & 2 deletions crates/stdlib/src/mmap.rs
Original file line number Diff line number Diff line change
Expand Up @@ -557,9 +557,15 @@ mod mmap {
// Parse tagname: None or a string
let tag_str: Option<String> = match tagname {
Some(ref obj) if !vm.is_none(obj) => {
Some(obj.try_to_value::<String>(vm).map_err(|_| {
let s = obj.try_to_value::<String>(vm).map_err(|_| {
vm.new_type_error("tagname must be a string or None".to_owned())
})?)
})?;
if s.contains('\0') {
return Err(vm.new_value_error(
"tagname must not contain null characters".to_owned(),
));
}
Some(s)
}
_ => None,
};
Expand Down
12 changes: 12 additions & 0 deletions crates/vm/src/stdlib/_winapi.rs
Original file line number Diff line number Diff line change
Expand Up @@ -1807,6 +1807,13 @@ mod _winapi {
) -> PyResult<WinHandle> {
use windows_sys::Win32::System::Memory::CreateFileMappingW;

if let Some(ref n) = name
&& n.as_str().contains('\0')
{
return Err(vm.new_value_error(
"CreateFileMapping: name must not contain null characters".to_owned(),
));
}
let name_wide = name.as_ref().map(|n| n.as_wtf8().to_wide_with_nul());
let name_ptr = name_wide.as_ref().map_or(null(), |n| n.as_ptr());

Expand Down Expand Up @@ -1837,6 +1844,11 @@ mod _winapi {
) -> PyResult<WinHandle> {
use windows_sys::Win32::System::Memory::OpenFileMappingW;

if name.as_str().contains('\0') {
return Err(vm.new_value_error(
"OpenFileMapping: name must not contain null characters".to_owned(),
));
}
let name_wide = name.as_wtf8().to_wide_with_nul();
let handle = unsafe {
OpenFileMappingW(
Expand Down
Loading