gh-140594: Fix an out of bounds read when feeding NUL byte to `PyOS_StdioReadline` by ashm-dev · Pull Request #140910 · python/cpython

ashm-dev · 2025-11-02T13:24:02Z

Issue: heap-buffer-overflow PyOS_StdioReadline Parser/myreadline.c #140594

picnixz

Please add tests.

bedevere-app · 2025-11-02T13:31:49Z

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

And if you don't make the requested changes, you will be poked with soft cushions!

picnixz · 2025-11-02T13:33:14Z

FTR, a buffer underflow is something entirely different.

ashm-dev · 2025-11-02T16:45:43Z

I have made the requested changes; please review again

bedevere-app · 2025-11-02T16:45:48Z

Thanks for making the requested changes!

@picnixz: please review the changes made to this pull request.

Misc/NEWS.d/next/Security/2025-11-02-16-23-17.gh-issue-140594.YIWUpl.rst

Lib/test/test_cmd_line.py

bedevere-app · 2025-11-02T16:53:45Z

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

…uard

ashm-dev · 2025-11-02T17:17:40Z

I have made the requested changes; please review again

picnixz

Using Popen seems an overkill.

Lib/test/test_cmd_line.py

Misc/NEWS.d/next/Security/2025-11-02-16-23-17.gh-issue-140594.YIWUpl.rst

Lib/test/test_cmd_line.py

bedevere-app · 2025-11-02T17:17:45Z

Thanks for making the requested changes!

@picnixz: please review the changes made to this pull request.

sergey-miryanov

Thanks!

efimov-mikhail

LGTM

Misc/NEWS.d/next/Core_and_Builtins/2025-11-02-16-23-17.gh-issue-140594.YIWUpl.rst

Parser/myreadline.c

ashm-dev · 2026-03-11T16:43:43Z

I have made the requested changes; please review again

bedevere-app · 2026-03-11T16:43:50Z

Thanks for making the requested changes!

@picnixz: please review the changes made to this pull request.

Lib/test/test_cmd_line.py

@picnixz

@picnixz reviews have been addressed.

vstinner · 2026-03-12T10:38:53Z

Aha, I reproduced the ASAN error using ./configure --with-address-sanitizer CC=clang LD=clang and #140594 (comment) reproducer.

$ ./python bug.py 
==3640856==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7ca08c6474ff at pc 0x00000059d67e bp 0x7fff55cd4c50 sp 0x7fff55cd4c48
READ of size 1 at 0x7ca08c6474ff thread T0
    #0 0x00000059d67d in PyOS_StdioReadline /home/vstinner/python/main/Parser/myreadline.c:347:14
    #1 0x00000059d8bf in PyOS_Readline /home/vstinner/python/main/Parser/myreadline.c:411:14
    ...

0x7ca08c6474ff is located 1 bytes before 100-byte region [0x7ca08c647500,0x7ca08c647564)
allocated by thread T0 here:
    #0 0x0000004a8d00 in realloc (/home/vstinner/python/main/python+0x4a8d00) (BuildId: 764499fff4f990ace65f94f78d08a62da34d9197)
    #1 0x00000059d536 in PyOS_StdioReadline /home/vstinner/python/main/Parser/myreadline.c:327:22
    ...
...

Using the ASAN build without the fix, the new test fails as expected:

FAIL: test_null_byte_in_interactive_mode (test.test_cmd_line.CmdLineTest.test_null_byte_in_interactive_mode)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/vstinner/python/main/Lib/test/test_cmd_line.py", line 209, in test_null_byte_in_interactive_mode
    self.assertEqual(proc.returncode, 0)
    ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^
AssertionError: 1 != 0

Using the ASAN build with the fix, the new test pass as expected.

vstinner

LGTM

miss-islington-app · 2026-03-12T10:58:42Z

Thanks @ashm-dev for the PR, and @vstinner for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

miss-islington-app · 2026-03-12T10:58:43Z

Thanks @ashm-dev for the PR, and @vstinner for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

…yOS_StdioReadline() (pythonGH-140910) (cherry picked from commit 86a0756) Co-authored-by: Shamil <ashm.tech@proton.me> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com> Co-authored-by: Victor Stinner <vstinner@python.org>

bedevere-app · 2026-03-12T10:58:55Z

GH-145852 is a backport of this pull request to the 3.14 branch.

bedevere-app · 2026-03-12T10:58:59Z

GH-145853 is a backport of this pull request to the 3.13 branch.

vstinner · 2026-03-12T11:00:45Z

Thanks @ashm-dev for the fix, I merged your PR and backported the fix to 3.13 and 3.14 branches.

Fix heap-buffer-overflow when reading null bytes

0463fb7

ashm-dev requested review from lysnikolaou and pablogsal as code owners November 2, 2025 13:24

bedevere-app bot added the awaiting review label Nov 2, 2025

bedevere-app bot mentioned this pull request Nov 2, 2025

heap-buffer-overflow PyOS_StdioReadline Parser/myreadline.c #140594

Closed

picnixz requested changes Nov 2, 2025

View reviewed changes

bedevere-app bot added awaiting changes and removed awaiting review labels Nov 2, 2025

picnixz changed the title ~~gh-140594: Fix buffer underflow in PyOS_StdioReadline on null bytes~~ gh-140594: Fix buffer overflow when feeding NULL bytes to PyOS_StdioReadline Nov 2, 2025

Add test for NUL byte in interactive mode

71d79ca

bedevere-app bot added awaiting change review and removed awaiting changes labels Nov 2, 2025

bedevere-app bot requested a review from picnixz November 2, 2025 16:45

picnixz requested changes Nov 2, 2025

View reviewed changes

bedevere-app bot added awaiting changes and removed awaiting change review labels Nov 2, 2025

test: refactor null byte interactive mode test to use EnvironmentVarG…

42fdcfb

…uard

ashm-dev force-pushed the asan branch from bf87683 to 42fdcfb Compare November 2, 2025 17:08

ashm-dev added 2 commits November 2, 2025 20:11

docs: improve security advisory for PyOS_StdioReadline fix

b09a4c8

test: remove unnecessary -S and -q flags from null byte test

976dedb

picnixz previously requested changes Nov 2, 2025

View reviewed changes

Lib/test/test_cmd_line.py Outdated Show resolved Hide resolved

Misc/NEWS.d/next/Security/2025-11-02-16-23-17.gh-issue-140594.YIWUpl.rst Outdated Show resolved Hide resolved

Lib/test/test_cmd_line.py Outdated Show resolved Hide resolved

bedevere-app bot added awaiting change review and removed awaiting changes labels Nov 2, 2025

sergey-miryanov approved these changes Nov 21, 2025

View reviewed changes

efimov-mikhail approved these changes Nov 21, 2025

View reviewed changes

vstinner reviewed Nov 28, 2025

View reviewed changes

Misc/NEWS.d/next/Core_and_Builtins/2025-11-02-16-23-17.gh-issue-140594.YIWUpl.rst Outdated Show resolved Hide resolved

Parser/myreadline.c Show resolved Hide resolved

Fix wording: out of bounds read, not buffer overflow

67895de

Merge branch 'main' into asan

919b64a

vstinner reviewed Mar 12, 2026

View reviewed changes

Lib/test/test_cmd_line.py Outdated Show resolved Hide resolved

Update Lib/test/test_cmd_line.py

32226a9

vstinner approved these changes Mar 12, 2026

View reviewed changes

bedevere-app bot added awaiting merge and removed awaiting change review labels Mar 12, 2026

vstinner enabled auto-merge (squash) March 12, 2026 10:41

vstinner merged commit 86a0756 into python:main Mar 12, 2026
53 of 54 checks passed

bedevere-app bot removed the awaiting merge label Mar 12, 2026

ashm-dev deleted the asan branch March 12, 2026 10:47

vstinner added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Mar 12, 2026

bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Mar 12, 2026

bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Mar 12, 2026

vstinner changed the title ~~gh-140594: Fix buffer overflow when feeding NULL bytes to PyOS_StdioReadline~~ gh-140594: Fix an out of bounds read when feeding NUL byte to PyOS_StdioReadline Mar 12, 2026

Uh oh!

Conversation

ashm-dev commented Nov 2, 2025 • edited by bedevere-app bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

picnixz left a comment

Choose a reason for hiding this comment

Uh oh!

bedevere-app bot commented Nov 2, 2025

Uh oh!

picnixz commented Nov 2, 2025

Uh oh!

ashm-dev commented Nov 2, 2025

Uh oh!

bedevere-app bot commented Nov 2, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bedevere-app bot commented Nov 2, 2025

Uh oh!

ashm-dev commented Nov 2, 2025

Uh oh!

picnixz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bedevere-app bot commented Nov 2, 2025

Uh oh!

sergey-miryanov left a comment

Choose a reason for hiding this comment

Uh oh!

efimov-mikhail left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ashm-dev commented Mar 11, 2026

Uh oh!

bedevere-app bot commented Mar 11, 2026

Uh oh!

Uh oh!

vstinner commented Mar 12, 2026

Uh oh!

vstinner left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

miss-islington-app bot commented Mar 12, 2026

Uh oh!

miss-islington-app bot commented Mar 12, 2026

Uh oh!

bedevere-app bot commented Mar 12, 2026

Uh oh!

bedevere-app bot commented Mar 12, 2026

Uh oh!

vstinner commented Mar 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

ashm-dev commented Nov 2, 2025 •

edited by bedevere-app bot

Loading