diff options
| author |   Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2020-07-10 03:18:45 -0700 |
|---|---|---|
| committer |   GitHub <noreply@github.com> | 2020-07-10 03:18:45 -0700 |
| commit | 51b36ed96d29c9440fbca18fb0c9e3087f763da5 (patch) | |
| tree | 9292654309c41e429358f2ab1c1bc7c0b50a70c4 | |
| parent | bpo-37765: Add keywords to IDLE tab completions (GH-15138) (diff) | |
| download | cpython-51b36ed96d29c9440fbca18fb0c9e3087f763da5.tar.gz cpython-51b36ed96d29c9440fbca18fb0c9e3087f763da5.tar.bz2 cpython-51b36ed96d29c9440fbca18fb0c9e3087f763da5.zip | |
bpo-41175: Guard against a NULL pointer dereference within bytearrayobject (GH-21240)
The issue is triggered by the bytearray() + bytearray() operation.
Detected by GCC 10 static analysis tool.
(cherry picked from commit 61fc23ca106bc82955b0e59d1ab42285b94899e2)
Co-authored-by: stratakis <cstratak@redhat.com>
| -rw-r--r-- | Misc/NEWS.d/next/Core and Builtins/2020-06-30-20-17-31.bpo-41175.acJoXB.rst | 2 | ||||
| -rw-r--r-- | Objects/bytearrayobject.c | 4 |
2 files changed, 5 insertions, 1 deletions
diff --git a/Misc/NEWS.d/next/Core and Builtins/2020-06-30-20-17-31.bpo-41175.acJoXB.rst b/Misc/NEWS.d/next/Core and Builtins/2020-06-30-20-17-31.bpo-41175.acJoXB.rst new file mode 100644 index 00000000000..844fb804c0c --- /dev/null +++ b/Misc/NEWS.d/next/Core and Builtins/2020-06-30-20-17-31.bpo-41175.acJoXB.rst @@ -0,0 +1,2 @@ +Guard against a NULL pointer dereference within bytearrayobject triggered by +the ``bytearray() + bytearray()`` operation. diff --git a/Objects/bytearrayobject.c b/Objects/bytearrayobject.c index 5a803be6277..97d7796769f 100644 --- a/Objects/bytearrayobject.c +++ b/Objects/bytearrayobject.c @@ -273,7 +273,9 @@ PyByteArray_Concat(PyObject *a, PyObject *b) result = (PyByteArrayObject *) \ PyByteArray_FromStringAndSize(NULL, va.len + vb.len); - if (result != NULL) { + // result->ob_bytes is NULL if result is an empty string: + // if va.len + vb.len equals zero. + if (result != NULL && result->ob_bytes != NULL) { memcpy(result->ob_bytes, va.buf, va.len); memcpy(result->ob_bytes + va.len, vb.buf, vb.len); } |