[3.14] gh-150633: Properly handle null characters in the name when importing frozen modules (GH-150634) (GH-151101)

miss-islington · KowalskiThomas · web-flow · commit 0977fc23fdc5 · 2026-06-08T18:56:49.000Z
(cherry picked from commit 54de547) Co-authored-by: Thomas Kowalski <thom.kowa@gmail.com>
diff --git a/Lib/test/test_import/__init__.py b/Lib/test/test_import/__init__.py
@@ -360,6 +360,15 @@ def test_import_raises_ModuleNotFoundError(self):
         with self.assertRaises(ModuleNotFoundError):
             import something_that_should_not_exist_anywhere
 
+    def test_import_null_byte_in_name_raises_ModuleNotFoundError(self):
+        # gh-150633: module names containing null bytes should not
+        # lead to duplicates in sys.modules
+        before = set(sys.modules.keys())
+        with self.assertRaises(ModuleNotFoundError):
+            __import__('zipimport\x00junk')
+
+        self.assertEqual(set(sys.modules.keys()), before)
+
     def test_from_import_missing_module_raises_ModuleNotFoundError(self):
         with self.assertRaises(ModuleNotFoundError):
             from something_that_should_not_exist_anywhere import blah
diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-05-30-20-19-35.gh-issue-150633.XkNul0.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-05-30-20-19-35.gh-issue-150633.XkNul0.rst
@@ -0,0 +1,3 @@
+Fix the frozen importer accepting module names with embedded null bytes, which
+caused it to bypass the :data:`sys.modules` cache and create duplicate module
+objects.
diff --git a/Python/import.c b/Python/import.c
@@ -3025,7 +3025,7 @@ find_frozen(PyObject *nameobj, struct frozen_info *info)
     if (nameobj == NULL || nameobj == Py_None) {
         return FROZEN_BAD_NAME;
     }
-    const char *name = PyUnicode_AsUTF8(nameobj);
+    const char *name = _PyUnicode_AsUTF8NoNUL(nameobj);
     if (name == NULL) {
         // Note that this function previously used
         // _PyUnicode_EqualToASCIIString().  We clear the error here

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+Fix the frozen importer accepting module names with embedded null bytes, which`
	`2`	+caused it to bypass the :data:`sys.modules` cache and create duplicate module
	`3`	`+objects.`
Original file line number	Diff line number	Diff line change
`@@ -3025,7 +3025,7 @@ find_frozen(PyObject nameobj, struct frozen_info info)`
`3025`	`3025`	`if (nameobj == NULL \|\| nameobj == Py_None) {`
`3026`	`3026`	`return FROZEN_BAD_NAME;`
`3027`	`3027`	`}`
`3028`		`- const char *name = PyUnicode_AsUTF8(nameobj);`
	`3028`	`+ const char *name = _PyUnicode_AsUTF8NoNUL(nameobj);`
`3029`	`3029`	`if (name == NULL) {`
`3030`	`3030`	`// Note that this function previously used`
`3031`	`3031`	`// _PyUnicode_EqualToASCIIString(). We clear the error here`