Repository navigation
Potential null pointer dereference in PySys_AddWarnOptionUnicode #126108
Description
Bug report
Bug description:
Pointer tstate is compared to a NULL value here, but above there is a dereference. Stack trace: _PySys_AddWarnOptionWithError -> get_warnoptions -> _PySys_GetAttr. Correct code should look like this:
void
PySys_AddWarnOptionUnicode(PyObject *option)
{
PyThreadState *tstate = _PyThreadState_GET();
if (tstate && _PySys_AddWarnOptionWithError(tstate, option) < 0) {
/* No return value, therefore clear error state if possible */
_PyErr_Clear(tstate);
}
}CPython versions tested on:
3.11
Operating systems tested on:
No response
Linked PRs
- gh-126108: Fix potential null pointer dereference in PySys_AddWarnOptionUnicode #126118
- [3.13] gh-126108: Fix potential null pointer dereference in
PySys_AddWarnOptionUnicode(GH-126118) #129520 - [3.12] gh-126108: Fix potential null pointer dereference in
PySys_AddWarnOptionUnicode(GH-126118) #129522
Activity
[-]Potential null pointer dereference[/-][+]Potential null pointer dereference in `PySys_AddWarnOptionUnicode`[/+]picnixz commentedon Oct 29, 2024
Thanks for spotting this. This still happens on
main. Feel free to open a PR (I can do it as well if you want).Note: 3.11 is security-only and this does not seem to count as a security issue unless someone is able to provide me a PoC of an exploit using that null pointer dereference.
picnixz commentedon Oct 29, 2024
cc @sobolevn since you are working on this batch of issues
sobolevn commentedon Oct 29, 2024
I haven't seen this one yet :)
gh-126108: Fix potential null pointer dereference in `PySys_AddWarnOp…
pythongh-126108: Fix potential null pointer dereference in `PySys_Add…
pythongh-126108: Fix potential null pointer dereference in `PySys_Add…
[3.12] gh-126108: Fix potential null pointer dereference in `PySys_Ad…
[3.13] gh-126108: Fix potential null pointer dereference in `PySys_Ad…
pythongh-126108: Fix potential null pointer dereference in `PySys_Add…