Fix heap-buffer-overflow when reading null bytes

ashm-dev · ashm-dev · commit 0463fb78fca1 · 2025-11-02T16:23:27.000+03:00
diff --git a/Misc/NEWS.d/next/Security/2025-11-02-16-23-17.gh-issue-140594.YIWUpl.rst b/Misc/NEWS.d/next/Security/2025-11-02-16-23-17.gh-issue-140594.YIWUpl.rst
@@ -0,0 +1,2 @@
+Fixed heap-buffer-overflow in PyOS_StdioReadline when encountering null
+bytes in interactive input. Patch by Shamil Abdulaev.
diff --git a/Parser/myreadline.c b/Parser/myreadline.c
@@ -344,7 +344,7 @@ PyOS_StdioReadline(FILE *sys_stdin, FILE *sys_stdout, const char *prompt)
             break;
         }
         n += strlen(p + n);
-    } while (p[n-1] != '\n');
+    } while (n > 0 && p[n-1] != '\n');
 
     pr = (char *)PyMem_RawRealloc(p, n+1);
     if (pr == NULL) {

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+Fixed heap-buffer-overflow in PyOS_StdioReadline when encountering null`
	`2`	`+bytes in interactive input. Patch by Shamil Abdulaev.`
Original file line number	Diff line number	Diff line change
`@@ -344,7 +344,7 @@ PyOS_StdioReadline(FILE sys_stdin, FILE sys_stdout, const char *prompt)`
`344`	`344`	`break;`
`345`	`345`	`}`
`346`	`346`	`n += strlen(p + n);`
`347`		`- } while (p[n-1] != '\n');`
	`347`	`+ } while (n > 0 && p[n-1] != '\n');`
`348`	`348`
`349`	`349`	`pr = (char *)PyMem_RawRealloc(p, n+1);`
`350`	`350`	`if (pr == NULL) {`