[Python-checkins] [3.11] gh-97728: Argument Clinic: Fix uninitialized variable in the Py_UNICODE converter (GH-97729) (GH-97757)
serhiy-storchaka
webhook-mailer at python.org
Mon Oct 3 08:02:15 EDT 2022
https://github.com/python/cpython/commit/f07ee4147980e20abe710e917b62258637b13c62
commit: f07ee4147980e20abe710e917b62258637b13c62
branch: 3.11
author: Serhiy Storchaka <storchaka at gmail.com>
committer: serhiy-storchaka <storchaka at gmail.com>
date: 2022-10-03T15:01:54+03:00
summary:
[3.11] gh-97728: Argument Clinic: Fix uninitialized variable in the Py_UNICODE converter (GH-97729) (GH-97757)
It affects function os.system() on Windows and Windows-specific modules
winreg, _winapi, _overlapped, and _msi.
(cherry picked from commit 0ee9619a4cba58730c45e65d22288fadbf7680de)
files:
A Misc/NEWS.d/next/Windows/2022-10-02-11-59-23.gh-issue-97728.dIdlPE.rst
M Lib/test/clinic.test
M Modules/clinic/_winapi.c.h
M Modules/clinic/overlapped.c.h
M Modules/clinic/posixmodule.c.h
M PC/clinic/_msi.c.h
M PC/clinic/winreg.c.h
M Tools/clinic/clinic.py
diff --git a/Lib/test/clinic.test b/Lib/test/clinic.test
index 9016cffba95c..0228d6be0326 100644
--- a/Lib/test/clinic.test
+++ b/Lib/test/clinic.test
@@ -1803,12 +1803,12 @@ static PyObject *
test_Py_UNICODE_converter(PyObject *module, PyObject *const *args, Py_ssize_t nargs)
{
PyObject *return_value = NULL;
- const Py_UNICODE *a;
- const Py_UNICODE *b;
- const Py_UNICODE *c;
- const Py_UNICODE *d;
+ const Py_UNICODE *a = NULL;
+ const Py_UNICODE *b = NULL;
+ const Py_UNICODE *c = NULL;
+ const Py_UNICODE *d = NULL;
Py_ssize_t d_length;
- const Py_UNICODE *e;
+ const Py_UNICODE *e = NULL;
Py_ssize_t e_length;
if (!_PyArg_ParseStack(args, nargs, "O&O&O&u#Z#:test_Py_UNICODE_converter",
@@ -1839,7 +1839,7 @@ test_Py_UNICODE_converter_impl(PyObject *module, const Py_UNICODE *a,
const Py_UNICODE *b, const Py_UNICODE *c,
const Py_UNICODE *d, Py_ssize_t d_length,
const Py_UNICODE *e, Py_ssize_t e_length)
-/*[clinic end generated code: output=45e92604de227552 input=064a3b68ad7f04b0]*/
+/*[clinic end generated code: output=9d41b3a38a0f6f2f input=064a3b68ad7f04b0]*/
/*[clinic input]
diff --git a/Misc/NEWS.d/next/Windows/2022-10-02-11-59-23.gh-issue-97728.dIdlPE.rst b/Misc/NEWS.d/next/Windows/2022-10-02-11-59-23.gh-issue-97728.dIdlPE.rst
new file mode 100644
index 000000000000..2a6a253a52ae
--- /dev/null
+++ b/Misc/NEWS.d/next/Windows/2022-10-02-11-59-23.gh-issue-97728.dIdlPE.rst
@@ -0,0 +1,3 @@
+Fix possible crashes caused by the use of uninitialized variables when pass
+invalid arguments in :func:`os.system` on Windows and in Windows-specific
+modules (like ``winreg``).
diff --git a/Modules/clinic/_winapi.c.h b/Modules/clinic/_winapi.c.h
index 87f624f9816d..118e7bfd29fe 100644
--- a/Modules/clinic/_winapi.c.h
+++ b/Modules/clinic/_winapi.c.h
@@ -192,7 +192,7 @@ _winapi_CreateFileMapping(PyObject *module, PyObject *const *args, Py_ssize_t na
DWORD protect;
DWORD max_size_high;
DWORD max_size_low;
- LPCWSTR name;
+ LPCWSTR name = NULL;
HANDLE _return_value;
if (!_PyArg_ParseStack(args, nargs, "" F_HANDLE "" F_POINTER "kkkO&:CreateFileMapping",
@@ -233,8 +233,8 @@ static PyObject *
_winapi_CreateJunction(PyObject *module, PyObject *const *args, Py_ssize_t nargs)
{
PyObject *return_value = NULL;
- LPCWSTR src_path;
- LPCWSTR dst_path;
+ LPCWSTR src_path = NULL;
+ LPCWSTR dst_path = NULL;
if (!_PyArg_CheckPositional("CreateJunction", nargs, 2, 2)) {
goto exit;
@@ -394,14 +394,14 @@ static PyObject *
_winapi_CreateProcess(PyObject *module, PyObject *const *args, Py_ssize_t nargs)
{
PyObject *return_value = NULL;
- const Py_UNICODE *application_name;
+ const Py_UNICODE *application_name = NULL;
PyObject *command_line;
PyObject *proc_attrs;
PyObject *thread_attrs;
BOOL inherit_handles;
DWORD creation_flags;
PyObject *env_mapping;
- const Py_UNICODE *current_directory;
+ const Py_UNICODE *current_directory = NULL;
PyObject *startup_info;
if (!_PyArg_ParseStack(args, nargs, "O&OOOikOO&O:CreateProcess",
@@ -749,7 +749,7 @@ _winapi_OpenFileMapping(PyObject *module, PyObject *const *args, Py_ssize_t narg
PyObject *return_value = NULL;
DWORD desired_access;
BOOL inherit_handle;
- LPCWSTR name;
+ LPCWSTR name = NULL;
HANDLE _return_value;
if (!_PyArg_ParseStack(args, nargs, "kiO&:OpenFileMapping",
@@ -1216,4 +1216,4 @@ _winapi__mimetypes_read_windows_registry(PyObject *module, PyObject *const *args
exit:
return return_value;
}
-/*[clinic end generated code: output=dfbccec8f11b7433 input=a9049054013a1b77]*/
+/*[clinic end generated code: output=60b036183b92659e input=a9049054013a1b77]*/
diff --git a/Modules/clinic/overlapped.c.h b/Modules/clinic/overlapped.c.h
index 286133831749..2f0520d3df4a 100644
--- a/Modules/clinic/overlapped.c.h
+++ b/Modules/clinic/overlapped.c.h
@@ -220,7 +220,7 @@ _overlapped_CreateEvent(PyObject *module, PyObject *const *args, Py_ssize_t narg
PyObject *EventAttributes;
BOOL ManualReset;
BOOL InitialState;
- const Py_UNICODE *Name;
+ const Py_UNICODE *Name = NULL;
if (!_PyArg_ParseStack(args, nargs, "OiiO&:CreateEvent",
&EventAttributes, &ManualReset, &InitialState, _PyUnicode_WideCharString_Opt_Converter, &Name)) {
@@ -806,7 +806,7 @@ static PyObject *
_overlapped_Overlapped_ConnectPipe(OverlappedObject *self, PyObject *arg)
{
PyObject *return_value = NULL;
- const Py_UNICODE *Address;
+ const Py_UNICODE *Address = NULL;
if (!PyUnicode_Check(arg)) {
_PyArg_BadArgument("ConnectPipe", "argument", "str", arg);
@@ -968,4 +968,4 @@ _overlapped_Overlapped_WSARecvFromInto(OverlappedObject *self, PyObject *const *
return return_value;
}
-/*[clinic end generated code: output=b0f15f5c09f1147e input=a9049054013a1b77]*/
+/*[clinic end generated code: output=8532bc0e4e1958ac input=a9049054013a1b77]*/
diff --git a/Modules/clinic/posixmodule.c.h b/Modules/clinic/posixmodule.c.h
index ca2699b4e366..e636f8b94ff7 100644
--- a/Modules/clinic/posixmodule.c.h
+++ b/Modules/clinic/posixmodule.c.h
@@ -1749,7 +1749,7 @@ os_system(PyObject *module, PyObject *const *args, Py_ssize_t nargs, PyObject *k
static const char * const _keywords[] = {"command", NULL};
static _PyArg_Parser _parser = {NULL, _keywords, "system", 0};
PyObject *argsbuf[1];
- const Py_UNICODE *command;
+ const Py_UNICODE *command = NULL;
long _return_value;
args = _PyArg_UnpackKeywords(args, nargs, NULL, kwnames, &_parser, 1, 1, 0, argsbuf);
@@ -9378,4 +9378,4 @@ os_waitstatus_to_exitcode(PyObject *module, PyObject *const *args, Py_ssize_t na
#ifndef OS_WAITSTATUS_TO_EXITCODE_METHODDEF
#define OS_WAITSTATUS_TO_EXITCODE_METHODDEF
#endif /* !defined(OS_WAITSTATUS_TO_EXITCODE_METHODDEF) */
-/*[clinic end generated code: output=3032d9c5c3aaa165 input=a9049054013a1b77]*/
+/*[clinic end generated code: output=836be9d51f01140e input=a9049054013a1b77]*/
diff --git a/PC/clinic/_msi.c.h b/PC/clinic/_msi.c.h
index fd2114215831..b717192b4833 100644
--- a/PC/clinic/_msi.c.h
+++ b/PC/clinic/_msi.c.h
@@ -195,7 +195,7 @@ _msi_Record_SetString(msiobj *self, PyObject *const *args, Py_ssize_t nargs)
{
PyObject *return_value = NULL;
int field;
- const Py_UNICODE *value;
+ const Py_UNICODE *value = NULL;
if (!_PyArg_CheckPositional("SetString", nargs, 2, 2)) {
goto exit;
@@ -244,7 +244,7 @@ _msi_Record_SetStream(msiobj *self, PyObject *const *args, Py_ssize_t nargs)
{
PyObject *return_value = NULL;
int field;
- const Py_UNICODE *value;
+ const Py_UNICODE *value = NULL;
if (!_PyArg_CheckPositional("SetStream", nargs, 2, 2)) {
goto exit;
@@ -555,7 +555,7 @@ static PyObject *
_msi_Database_OpenView(msiobj *self, PyObject *arg)
{
PyObject *return_value = NULL;
- const Py_UNICODE *sql;
+ const Py_UNICODE *sql = NULL;
if (!PyUnicode_Check(arg)) {
_PyArg_BadArgument("OpenView", "argument", "str", arg);
@@ -650,7 +650,7 @@ static PyObject *
_msi_OpenDatabase(PyObject *module, PyObject *const *args, Py_ssize_t nargs)
{
PyObject *return_value = NULL;
- const Py_UNICODE *path;
+ const Py_UNICODE *path = NULL;
int persist;
if (!_PyArg_CheckPositional("OpenDatabase", nargs, 2, 2)) {
@@ -713,4 +713,4 @@ _msi_CreateRecord(PyObject *module, PyObject *arg)
exit:
return return_value;
}
-/*[clinic end generated code: output=d7eb07e6bfcdc13f input=a9049054013a1b77]*/
+/*[clinic end generated code: output=276175d60fbfc956 input=a9049054013a1b77]*/
diff --git a/PC/clinic/winreg.c.h b/PC/clinic/winreg.c.h
index 2507e46e2633..a413dec5dda5 100644
--- a/PC/clinic/winreg.c.h
+++ b/PC/clinic/winreg.c.h
@@ -148,7 +148,7 @@ static PyObject *
winreg_ConnectRegistry(PyObject *module, PyObject *const *args, Py_ssize_t nargs)
{
PyObject *return_value = NULL;
- const Py_UNICODE *computer_name;
+ const Py_UNICODE *computer_name = NULL;
HKEY key;
HKEY _return_value;
@@ -220,7 +220,7 @@ winreg_CreateKey(PyObject *module, PyObject *const *args, Py_ssize_t nargs)
{
PyObject *return_value = NULL;
HKEY key;
- const Py_UNICODE *sub_key;
+ const Py_UNICODE *sub_key = NULL;
HKEY _return_value;
if (!_PyArg_CheckPositional("CreateKey", nargs, 2, 2)) {
@@ -301,7 +301,7 @@ winreg_CreateKeyEx(PyObject *module, PyObject *const *args, Py_ssize_t nargs, Py
static const char * const _keywords[] = {"key", "sub_key", "reserved", "access", NULL};
static _PyArg_Parser _parser = {"O&O&|ii:CreateKeyEx", _keywords, 0};
HKEY key;
- const Py_UNICODE *sub_key;
+ const Py_UNICODE *sub_key = NULL;
int reserved = 0;
REGSAM access = KEY_WRITE;
HKEY _return_value;
@@ -354,7 +354,7 @@ winreg_DeleteKey(PyObject *module, PyObject *const *args, Py_ssize_t nargs)
{
PyObject *return_value = NULL;
HKEY key;
- const Py_UNICODE *sub_key;
+ const Py_UNICODE *sub_key = NULL;
if (!_PyArg_CheckPositional("DeleteKey", nargs, 2, 2)) {
goto exit;
@@ -428,7 +428,7 @@ winreg_DeleteKeyEx(PyObject *module, PyObject *const *args, Py_ssize_t nargs, Py
static const char * const _keywords[] = {"key", "sub_key", "access", "reserved", NULL};
static _PyArg_Parser _parser = {"O&O&|ii:DeleteKeyEx", _keywords, 0};
HKEY key;
- const Py_UNICODE *sub_key;
+ const Py_UNICODE *sub_key = NULL;
REGSAM access = KEY_WOW64_64KEY;
int reserved = 0;
@@ -469,7 +469,7 @@ winreg_DeleteValue(PyObject *module, PyObject *const *args, Py_ssize_t nargs)
{
PyObject *return_value = NULL;
HKEY key;
- const Py_UNICODE *value;
+ const Py_UNICODE *value = NULL;
if (!_PyArg_CheckPositional("DeleteValue", nargs, 2, 2)) {
goto exit;
@@ -619,7 +619,7 @@ static PyObject *
winreg_ExpandEnvironmentStrings(PyObject *module, PyObject *arg)
{
PyObject *return_value = NULL;
- const Py_UNICODE *string;
+ const Py_UNICODE *string = NULL;
if (!PyUnicode_Check(arg)) {
_PyArg_BadArgument("ExpandEnvironmentStrings", "argument", "str", arg);
@@ -724,8 +724,8 @@ winreg_LoadKey(PyObject *module, PyObject *const *args, Py_ssize_t nargs)
{
PyObject *return_value = NULL;
HKEY key;
- const Py_UNICODE *sub_key;
- const Py_UNICODE *file_name;
+ const Py_UNICODE *sub_key = NULL;
+ const Py_UNICODE *file_name = NULL;
if (!_PyArg_CheckPositional("LoadKey", nargs, 3, 3)) {
goto exit;
@@ -805,7 +805,7 @@ winreg_OpenKey(PyObject *module, PyObject *const *args, Py_ssize_t nargs, PyObje
static const char * const _keywords[] = {"key", "sub_key", "reserved", "access", NULL};
static _PyArg_Parser _parser = {"O&O&|ii:OpenKey", _keywords, 0};
HKEY key;
- const Py_UNICODE *sub_key;
+ const Py_UNICODE *sub_key = NULL;
int reserved = 0;
REGSAM access = KEY_READ;
HKEY _return_value;
@@ -862,7 +862,7 @@ winreg_OpenKeyEx(PyObject *module, PyObject *const *args, Py_ssize_t nargs, PyOb
static const char * const _keywords[] = {"key", "sub_key", "reserved", "access", NULL};
static _PyArg_Parser _parser = {"O&O&|ii:OpenKeyEx", _keywords, 0};
HKEY key;
- const Py_UNICODE *sub_key;
+ const Py_UNICODE *sub_key = NULL;
int reserved = 0;
REGSAM access = KEY_READ;
HKEY _return_value;
@@ -953,7 +953,7 @@ winreg_QueryValue(PyObject *module, PyObject *const *args, Py_ssize_t nargs)
{
PyObject *return_value = NULL;
HKEY key;
- const Py_UNICODE *sub_key;
+ const Py_UNICODE *sub_key = NULL;
if (!_PyArg_CheckPositional("QueryValue", nargs, 2, 2)) {
goto exit;
@@ -1016,7 +1016,7 @@ winreg_QueryValueEx(PyObject *module, PyObject *const *args, Py_ssize_t nargs)
{
PyObject *return_value = NULL;
HKEY key;
- const Py_UNICODE *name;
+ const Py_UNICODE *name = NULL;
if (!_PyArg_CheckPositional("QueryValueEx", nargs, 2, 2)) {
goto exit;
@@ -1084,7 +1084,7 @@ winreg_SaveKey(PyObject *module, PyObject *const *args, Py_ssize_t nargs)
{
PyObject *return_value = NULL;
HKEY key;
- const Py_UNICODE *file_name;
+ const Py_UNICODE *file_name = NULL;
if (!_PyArg_CheckPositional("SaveKey", nargs, 2, 2)) {
goto exit;
@@ -1153,7 +1153,7 @@ winreg_SetValue(PyObject *module, PyObject *const *args, Py_ssize_t nargs)
{
PyObject *return_value = NULL;
HKEY key;
- const Py_UNICODE *sub_key;
+ const Py_UNICODE *sub_key = NULL;
DWORD type;
PyObject *value_obj;
@@ -1228,7 +1228,7 @@ winreg_SetValueEx(PyObject *module, PyObject *const *args, Py_ssize_t nargs)
{
PyObject *return_value = NULL;
HKEY key;
- const Py_UNICODE *value_name;
+ const Py_UNICODE *value_name = NULL;
PyObject *reserved;
DWORD type;
PyObject *value;
@@ -1349,4 +1349,4 @@ winreg_QueryReflectionKey(PyObject *module, PyObject *arg)
exit:
return return_value;
}
-/*[clinic end generated code: output=7ad1db69bc42cab4 input=a9049054013a1b77]*/
+/*[clinic end generated code: output=e83bdaabb4fa2167 input=a9049054013a1b77]*/
diff --git a/Tools/clinic/clinic.py b/Tools/clinic/clinic.py
index cd0446dc4f05..97d8d0a9410b 100755
--- a/Tools/clinic/clinic.py
+++ b/Tools/clinic/clinic.py
@@ -3522,6 +3522,7 @@ def converter_init(self, *, accept={str}, zeroes=False):
self.converter = '_PyUnicode_WideCharString_Opt_Converter'
else:
fail("Py_UNICODE_converter: illegal 'accept' argument " + repr(accept))
+ self.c_default = "NULL"
def cleanup(self):
if not self.length:
More information about the Python-checkins
mailing list