[Python-checkins] bpo-41175: Guard against a NULL pointer dereference within bytearrayobject (GH-21240)

[Miss Islington (bot)]

https://github.com/python/cpython/commit/33672c019179be279ae979f709c974593fbbbe84
commit: 33672c019179be279ae979f709c974593fbbbe84
branch: 3.8
author: Miss Islington (bot) <31488909+miss-islington at users.noreply.github.com>
committer: GitHub <noreply at github.com>
date: 2020-07-10T03:15:59-07:00
summary:

bpo-41175: Guard against a NULL pointer dereference within bytearrayobject (GH-21240)


The issue is triggered by the bytearray() + bytearray() operation.

Detected by GCC 10 static analysis tool.
(cherry picked from commit 61fc23ca106bc82955b0e59d1ab42285b94899e2)

Co-authored-by: stratakis <cstratak at redhat.com>

files:
A Misc/NEWS.d/next/Core and Builtins/2020-06-30-20-17-31.bpo-41175.acJoXB.rst
M Objects/bytearrayobject.c

diff --git a/Misc/NEWS.d/next/Core and Builtins/2020-06-30-20-17-31.bpo-41175.acJoXB.rst b/Misc/NEWS.d/next/Core and Builtins/2020-06-30-20-17-31.bpo-41175.acJoXB.rst
new file mode 100644
index 0000000000000..844fb804c0c8d
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and Builtins/2020-06-30-20-17-31.bpo-41175.acJoXB.rst	
@@ -0,0 +1,2 @@
+Guard against a NULL pointer dereference within bytearrayobject triggered by
+the ``bytearray() + bytearray()`` operation.
diff --git a/Objects/bytearrayobject.c b/Objects/bytearrayobject.c
index 590b806056186..d4d02336b6cf0 100644
--- a/Objects/bytearrayobject.c
+++ b/Objects/bytearrayobject.c
@@ -276,7 +276,9 @@ PyByteArray_Concat(PyObject *a, PyObject *b)
 
     result = (PyByteArrayObject *) \
         PyByteArray_FromStringAndSize(NULL, va.len + vb.len);
-    if (result != NULL) {
+    // result->ob_bytes is NULL if result is an empty string:
+    // if va.len + vb.len equals zero.
+    if (result != NULL && result->ob_bytes != NULL) {
         memcpy(result->ob_bytes, va.buf, va.len);
         memcpy(result->ob_bytes + va.len, vb.buf, vb.len);
     }