GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-140594: Fix an out of bounds read when feeding NUL byte to `PyOS_StdioReadline` by ashm-dev · Pull Request #140910 · python/cpython

Conversation

@ashm-dev

@ashm-dev ashm-dev commented Nov 2, 2025 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor
  • Issue: heap-buffer-overflow PyOS_StdioReadline Parser/myreadline.c #140594

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@ashm-dev
Fix heap-buffer-overflow when reading null bytes
0463fb7
@ashm-dev
ashm-dev requested review from lysnikolaou and pablogsal as code owners November 2, 2025 13:24
@bedevere-app bedevere-app Bot added the awaiting review label Nov 2, 2025
@bedevere-app bedevere-app Bot mentioned this pull request Nov 2, 2025
heap-buffer-overflow PyOS_StdioReadline Parser/myreadline.c #140594
Closed
picnixz
picnixz requested changes Nov 2, 2025
View reviewed changes

@picnixz picnixz left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add tests.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@bedevere-app bedevere-app Bot added awaiting changes and removed awaiting review labels Nov 2, 2025
@bedevere-app

bedevere-app Bot commented Nov 2, 2025

Copy link
Copy Markdown

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

And if you don't make the requested changes, you will be poked with soft cushions!

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@picnixz picnixz changed the title gh-140594: Fix buffer underflow in PyOS_StdioReadline on null bytes gh-140594: Fix buffer overflow when feeding NULL bytes to PyOS_StdioReadline Nov 2, 2025
@picnixz

picnixz commented Nov 2, 2025

Copy link
Copy Markdown
Member

FTR, a buffer underflow is something entirely different.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@ashm-dev
Add test for NUL byte in interactive mode
71d79ca
@ashm-dev

ashm-dev commented Nov 2, 2025

Copy link
Copy Markdown
Contributor Author

I have made the requested changes; please review again

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-app bedevere-app Bot added awaiting change review and removed awaiting changes labels Nov 2, 2025
@bedevere-app

bedevere-app Bot commented Nov 2, 2025

Copy link
Copy Markdown

Thanks for making the requested changes!

@picnixz: please review the changes made to this pull request.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-app
bedevere-app Bot requested a review from picnixz November 2, 2025 16:45
picnixz
picnixz requested changes Nov 2, 2025
View reviewed changes
Comment thread Misc/NEWS.d/next/Security/2025-11-02-16-23-17.gh-issue-140594.YIWUpl.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread Lib/test/test_cmd_line.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread Lib/test/test_cmd_line.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread Lib/test/test_cmd_line.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread Lib/test/test_cmd_line.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-app bedevere-app Bot added awaiting changes and removed awaiting change review labels Nov 2, 2025
@bedevere-app

bedevere-app Bot commented Nov 2, 2025

Copy link
Copy Markdown

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@ashm-dev
test: refactor null byte interactive mode test to use EnvironmentVarG…
42fdcfb
…uard
@ashm-dev
ashm-dev force-pushed the asan branch from bf87683 to 42fdcfb Compare November 2, 2025 17:08
ashm-dev added 2 commits November 2, 2025 20:11
@ashm-dev
docs: improve security advisory for PyOS_StdioReadline fix
b09a4c8
@ashm-dev
test: remove unnecessary -S and -q flags from null byte test
976dedb
@ashm-dev

ashm-dev commented Nov 2, 2025

Copy link
Copy Markdown
Contributor Author

I have made the requested changes; please review again

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

picnixz
picnixz previously requested changes Nov 2, 2025
View reviewed changes

@picnixz picnixz left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using Popen seems an overkill.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
Comment thread Lib/test/test_cmd_line.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread Misc/NEWS.d/next/Security/2025-11-02-16-23-17.gh-issue-140594.YIWUpl.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread Lib/test/test_cmd_line.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-app bedevere-app Bot added awaiting change review and removed awaiting changes labels Nov 2, 2025
@bedevere-app

bedevere-app Bot commented Nov 2, 2025

Copy link
Copy Markdown

Thanks for making the requested changes!

@picnixz: please review the changes made to this pull request.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@ashm-dev
Fix wording: out of bounds read, not buffer overflow
67895de
@ashm-dev

ashm-dev commented Mar 11, 2026

Copy link
Copy Markdown
Contributor Author

I have made the requested changes; please review again

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-app

bedevere-app Bot commented Mar 11, 2026

Copy link
Copy Markdown

Thanks for making the requested changes!

@picnixz: please review the changes made to this pull request.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@ashm-dev
Merge branch 'main' into asan
919b64a
vstinner
vstinner reviewed Mar 12, 2026
View reviewed changes
Comment thread Lib/test/test_cmd_line.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

@vstinner
Update Lib/test/test_cmd_line.py
32226a9
@vstinner
vstinner dismissed picnixz’s stale review March 12, 2026 10:23

@picnixz reviews have been addressed.

@vstinner

vstinner commented Mar 12, 2026

Copy link
Copy Markdown
Member

Aha, I reproduced the ASAN error using ./configure --with-address-sanitizer CC=clang LD=clang and #140594 (comment) reproducer.

$ ./python bug.py 
==3640856==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7ca08c6474ff at pc 0x00000059d67e bp 0x7fff55cd4c50 sp 0x7fff55cd4c48
READ of size 1 at 0x7ca08c6474ff thread T0
    #0 0x00000059d67d in PyOS_StdioReadline /home/vstinner/python/main/Parser/myreadline.c:347:14
    #1 0x00000059d8bf in PyOS_Readline /home/vstinner/python/main/Parser/myreadline.c:411:14
    ...

0x7ca08c6474ff is located 1 bytes before 100-byte region [0x7ca08c647500,0x7ca08c647564)
allocated by thread T0 here:
    #0 0x0000004a8d00 in realloc (/home/vstinner/python/main/python+0x4a8d00) (BuildId: 764499fff4f990ace65f94f78d08a62da34d9197)
    #1 0x00000059d536 in PyOS_StdioReadline /home/vstinner/python/main/Parser/myreadline.c:327:22
    ...
...

Using the ASAN build without the fix, the new test fails as expected:

FAIL: test_null_byte_in_interactive_mode (test.test_cmd_line.CmdLineTest.test_null_byte_in_interactive_mode)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/vstinner/python/main/Lib/test/test_cmd_line.py", line 209, in test_null_byte_in_interactive_mode
    self.assertEqual(proc.returncode, 0)
    ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^
AssertionError: 1 != 0

Using the ASAN build with the fix, the new test pass as expected.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

vstinner
vstinner approved these changes Mar 12, 2026
View reviewed changes

@vstinner vstinner left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

sergey-miryanov reacted with thumbs up emoji ashm-dev reacted with heart emoji
All reactions
  • 👍 1 reaction
  • ❤️ 1 reaction
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting change review labels Mar 12, 2026
@vstinner
vstinner enabled auto-merge (squash) March 12, 2026 10:41
@vstinner
vstinner merged commit 86a0756 into python:main Mar 12, 2026
53 of 54 checks passed

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-app bedevere-app Bot removed the awaiting merge label Mar 12, 2026
@ashm-dev
ashm-dev deleted the asan branch March 12, 2026 10:47
@vstinner vstinner added needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes labels Mar 12, 2026
@miss-islington-app

miss-islington-app Bot commented Mar 12, 2026

Copy link
Copy Markdown

Thanks @ashm-dev for the PR, and @vstinner for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@miss-islington-app

miss-islington-app Bot commented Mar 12, 2026

Copy link
Copy Markdown

Thanks @ashm-dev for the PR, and @vstinner for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Mar 12, 2026
@ashm-dev @picnixz
@vstinner @miss-islington
pythongh-140594: Fix an out of bounds read when feeding NUL byte to P…
68a43c2
…yOS_StdioReadline() (pythonGH-140910)

(cherry picked from commit 86a0756)

Co-authored-by: Shamil <[email protected]>
Co-authored-by: Bénédikt Tran <[email protected]>
Co-authored-by: Victor Stinner <[email protected]>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Mar 12, 2026
@ashm-dev @picnixz
@vstinner @miss-islington
pythongh-140594: Fix an out of bounds read when feeding NUL byte to P…
3fd5283
…yOS_StdioReadline() (pythonGH-140910)

(cherry picked from commit 86a0756)

Co-authored-by: Shamil <[email protected]>
Co-authored-by: Bénédikt Tran <[email protected]>
Co-authored-by: Victor Stinner <[email protected]>
@bedevere-app

bedevere-app Bot commented Mar 12, 2026

Copy link
Copy Markdown

GH-145852 is a backport of this pull request to the 3.14 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Mar 12, 2026
@bedevere-app

bedevere-app Bot commented Mar 12, 2026

Copy link
Copy Markdown

GH-145853 is a backport of this pull request to the 3.13 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-app bedevere-app Bot removed the needs backport to 3.13 only security fixes label Mar 12, 2026
@vstinner vstinner changed the title gh-140594: Fix buffer overflow when feeding NULL bytes to PyOS_StdioReadline gh-140594: Fix an out of bounds read when feeding NUL byte to PyOS_StdioReadline Mar 12, 2026
@vstinner

vstinner commented Mar 12, 2026

Copy link
Copy Markdown
Member

Thanks @ashm-dev for the fix, I merged your PR and backported the fix to 3.13 and 3.14 branches.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

vstinner added a commit that referenced this pull request Mar 12, 2026
@miss-islington @ashm-dev
@picnixz @vstinner
[3.13] gh-140594: Fix an out of bounds read when feeding NUL byte to …
e989361
…PyOS_StdioReadline() (GH-140910) (#145853)

gh-140594: Fix an out of bounds read when feeding NUL byte to PyOS_StdioReadline() (GH-140910)
(cherry picked from commit 86a0756)

Co-authored-by: Shamil <[email protected]>
Co-authored-by: Bénédikt Tran <[email protected]>
Co-authored-by: Victor Stinner <[email protected]>
vstinner added a commit that referenced this pull request Mar 12, 2026
@miss-islington @ashm-dev
@picnixz @vstinner
[3.14] gh-140594: Fix an out of bounds read when feeding NUL byte to …
295f214
…PyOS_StdioReadline() (GH-140910) (#145852)

gh-140594: Fix an out of bounds read when feeding NUL byte to PyOS_StdioReadline() (GH-140910)
(cherry picked from commit 86a0756)

Co-authored-by: Shamil <[email protected]>
Co-authored-by: Bénédikt Tran <[email protected]>
Co-authored-by: Victor Stinner <[email protected]>
ljfp pushed a commit to ljfp/cpython that referenced this pull request Apr 25, 2026
@ashm-dev @picnixz
@vstinner @ljfp
pythongh-140594: Fix an out of bounds read when feeding NUL byte to P…
1219930
…yOS_StdioReadline() (python#140910)

Co-authored-by: Bénédikt Tran <[email protected]>
Co-authored-by: Victor Stinner <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sergey-miryanov sergey-miryanov sergey-miryanov approved these changes
@efimov-mikhail efimov-mikhail efimov-mikhail approved these changes
@vstinner vstinner vstinner approved these changes
@pablogsal pablogsal Awaiting requested review from pablogsal pablogsal is a code owner
@lysnikolaou lysnikolaou Awaiting requested review from lysnikolaou lysnikolaou is a code owner
@picnixz picnixz Awaiting requested review from picnixz

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

5 participants

@ashm-dev @picnixz @efimov-mikhail @vstinner @sergey-miryanov
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.