Description

Aruise

opened on Oct 30, 2026

Issue body actions

Bug report

Potentially, if "value" equals NULL and "spec->type" equals "PyConfig_MEMBER_WSTR_OPT", null will be passed into "utf8_to_wstr" function and might cause a segmentation fault in strlen

cpython/Python/initconfig.c

Lines 4369 to 4376 in d3a1e72

	if (value == NULL && spec->type != PyConfig_MEMBER_WSTR_OPT) {
	initconfig_set_error(config, "config option string cannot be NULL");
	return -1;
	}
	wchar_t **member = raw_member;
	wchar_t *wstr = utf8_to_wstr(config, value);

cpython/Python/initconfig.c

Lines 4324 to 4328 in d3a1e72

	utf8_to_wstr(PyInitConfig *config, const char *str)
	{
	wchar_t *wstr;
	size_t wlen;
	int res = _Py_DecodeUTF8(str, strlen(str), &wstr, &wlen, _Py_ERROR_STRICT);

Documentation states that "value" is a null-terminated UTF-8 string, but isn't clearly stating that Null is allowed

Suggested fix: separate "value" and "spec->type" checks

if (value == NULL) { 
        if (spec->type != PyConfig_MEMBER_WSTR_OPT) {
               nitconfig_set_error(config, "config option string cannot be NULL");
               return -1;
               }
    wchar_t **member = raw_member;
    free(*member);
    *member = wstr;
    return 0;
}

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs

• gh-160962: Fix PyInitConfig_SetStr() with NULL value #161258
• [3.15] gh-160962: Fix PyInitConfig_SetStr() with NULL value (GH-161258) #161291
• [3.14] gh-160962: Fix PyInitConfig_SetStr() with NULL value (GH-161258) #161292

Activity

1. Aruise

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Oct 30, 2026
2. Aruise

   changed the title [-]Null derefication of a pointer in initconfig.c[/-] [+]Null dereferencing of a pointer in initconfig.c[/+] on Oct 30, 2026
3. lazerg commented on Oct 30, 2026

   

   lazerg

   on Oct 30, 2026

   Contributor

   More actions

   I will work on it if maintainers approve
4. picnixz commented on Oct 30, 2026

   

   picnixz

   on Oct 30, 2026

   Member

   More actions

   How can a NUL-terminated UTF8 string be NULL? are other functions checking for nullity? i believe this is unnecessary churn.

   Reacted by Stan Ulbrych
5. picnixz

   added

   pendingThe issue will be closed if no feedback is providedThe issue will be closed if no feedback is provided

   on Oct 30, 2026
6. Aruise commented on Oct 30, 2026

   

   Aruise

   on Oct 30, 2026

   Author

   More actions

   @picnixz
   It does describe "value" as a null-terminated UTF-8 string, yes, which indeed does not explicitly allow NULL

   However, the implementation explicitly checks whether "value" is NULL, suggesting that NULL might have been intended to be supported at some point
7. NekoAsakura

   added

   interpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)

   topic-C-API

   on Oct 30, 2026
8. NekoAsakura commented on Oct 30, 2026

   

   NekoAsakura

   on Oct 30, 2026

   Member

   More actions

   Reproduced on main:

   #include <Python.h>
   
   int main(void)
   {
       PyInitConfig *config = PyInitConfig_Create();
       return PyInitConfig_SetStr(config, "prefix", NULL);
   }

   #0  __strlen_avx2 ()
   #1  utf8_to_wstr (config=..., str=0x0) at Python/initconfig.c:4328
   #2  PyInitConfig_SetStr (config=..., name=..., value=0x0) at Python/initconfig.c:4376
   #3  main ()
   

   Original implementation (#123502) added the NULL check with an explicit exemption for PyConfig_MEMBER_WSTR_OPT, but had no return -1:
   

   cpython/Python/initconfig.c

   Lines 3809 to 3815 in ef9d547

   	if (value == NULL && spec->type != PyConfig_MEMBER_WSTR_OPT) {
   	initconfig_set_error(config, "config option string cannot be NULL");
   	}
   	wchar_t **member = raw_member;
   	*member = utf8_to_wstr(config, value);

   
   It was partially fixed in #159769 (comment), but left the WSTR_OPT exemption as-is.

   cc @vstinner
9. NekoAsakura

   removed

   pendingThe issue will be closed if no feedback is providedThe issue will be closed if no feedback is provided

   on Oct 30, 2026
10. sobolevn commented on Nov 3, 2026

    

    sobolevn

    on Nov 3, 2026

    Member

    More actions

    This was fixed in 395d766
11. sobolevn

    closed this as completedon Nov 3, 2026
12. NekoAsakura commented on Nov 3, 2026

    

    NekoAsakura

    on Nov 3, 2026

    Member

    More actions

    10. This was fixed in 395d766

    That only fixed the non-WSTR_OPT path.
13. NekoAsakura

    reopened this on Nov 3, 2026
14. vstinner

    added a commit that references this issue on Nov 3, 2026

    pythongh-160962: Fix PyInitConfig_SetStr() with NULL value

    d9eae76
15. vstinner commented on Nov 3, 2026

    

    vstinner

    on Nov 3, 2026

    Member

    More actions

    Hi. I wrote #161258 to fix PyInitConfig_SetStr() crash when the value is NULL. The PR also adds multiple tests on all Get functions.
16. vstinner

    added 3 commits that reference this issue on Nov 4, 2026

    gh-160962: Fix PyInitConfig_SetStr() with NULL value (#161258)

    6d69297

    [3.15] gh-160962: Fix PyInitConfig_SetStr() with NULL value (GH-161258)…

    22bc41d

    [3.14] gh-160962: Fix PyInitConfig_SetStr() with NULL value (GH-161258)…

    d16d33a
17. vstinner commented on Nov 4, 2026

    

    vstinner

    on Nov 4, 2026

    Member

    More actions

    Thanks for the bug report, I merged my fix.
18. vstinner

    closed this as completedon Nov 4, 2026

Issue actions