gh-140594: Fix buffer overflow when feeding NULL bytes to `PyOS_StdioReadline` #140910

ashm-dev · 2025-11-02T13:24:02Z

Issue: heap-buffer-overflow PyOS_StdioReadline Parser/myreadline.c #140594

picnixz

Please add tests.

bedevere-app · 2025-11-02T13:31:49Z

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

And if you don't make the requested changes, you will be poked with soft cushions!

picnixz · 2025-11-02T13:33:14Z

FTR, a buffer underflow is something entirely different.

ashm-dev · 2025-11-02T16:45:43Z

I have made the requested changes; please review again

bedevere-app · 2025-11-02T16:45:48Z

Thanks for making the requested changes!

@picnixz: please review the changes made to this pull request.

Misc/NEWS.d/next/Security/2025-11-02-16-23-17.gh-issue-140594.YIWUpl.rst

Lib/test/test_cmd_line.py

bedevere-app · 2025-11-02T16:53:45Z

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

…uard

ashm-dev · 2025-11-02T17:17:40Z

I have made the requested changes; please review again

picnixz

Using Popen seems an overkill.

Lib/test/test_cmd_line.py

Misc/NEWS.d/next/Security/2025-11-02-16-23-17.gh-issue-140594.YIWUpl.rst

Lib/test/test_cmd_line.py

bedevere-app · 2025-11-02T17:17:45Z

Thanks for making the requested changes!

@picnixz: please review the changes made to this pull request.

ashm-dev · 2025-11-03T08:16:13Z

I have made the requested changes; please review again

bedevere-app · 2025-11-03T08:16:18Z

Thanks for making the requested changes!

@picnixz: please review the changes made to this pull request.

picnixz · 2025-11-03T08:34:24Z

By the way, have you tried to reproduce the issue without JIT and with the GIL as I suggested? I didn't check myself so I wondered whether you did so or not and whether you were able to reproduce the bug on main.

ashm-dev · 2025-11-03T08:39:32Z

It reproduces ONLY when built with ASAN; in all other build variants, there’s no error.

I tried many different combinations:
jit + asan
gil + asan
debug + asan
but it only reproduced with a plain ASAN build.

Parser/myreadline.c

Lib/test/test_cmd_line.py

efimov-mikhail · 2025-11-20T17:50:13Z

It seems that NEWS entry here is located at Security section.
But issue doesn't have "type-security" label.
We have to decide is it really security issue or not.

Lib/test/test_cmd_line.py

Misc/NEWS.d/next/Core_and_Builtins/2025-11-02-16-23-17.gh-issue-140594.YIWUpl.rst

sergey-miryanov

Thanks!

efimov-mikhail

LGTM

vstinner · 2025-11-28T11:48:20Z

Misc/NEWS.d/next/Core_and_Builtins/2025-11-02-16-23-17.gh-issue-140594.YIWUpl.rst

@@ -0,0 +1,2 @@
+Fix a buffer overflow when a single NULL character is read from the standard input.


It's not a buffer overflow, "just" a read out of bounds.

Suggested change

Fix a buffer overflow when a single NULL character is read from the standard input.

Fix an out of bounds read when a single NUL character is read from the standard input.

vstinner · 2025-11-28T11:48:54Z

Parser/myreadline.c

        }
        n += strlen(p + n);
-    } while (p[n-1] != '\n');
+    } while (n == 0 || p[n-1] != '\n');


I would prefer to stop the loop if n==0.

Suggested change

} while (n == 0 || p[n-1] != '\n');

} while (n != 0 && p[n-1] != '\n');

Then input like b'\x00spam\nham\nspam\n' will stop early. Is this intended?

I'm not sure which behavior is the correct behavior honestly.

I suppose that you should call readline again to read spam\n.

It sounds worth it to add a test at least.

Then behavior will be different if string starts with NUL byte or has it in the middle. I think we should document this difference.

We already have this conversation here: #140910 (comment).
Current fix seems to be slightly better for me.

Fix heap-buffer-overflow when reading null bytes

0463fb7

ashm-dev requested review from lysnikolaou and pablogsal as code owners November 2, 2025 13:24

bedevere-app bot added the awaiting review label Nov 2, 2025

bedevere-app bot mentioned this pull request Nov 2, 2025

heap-buffer-overflow PyOS_StdioReadline Parser/myreadline.c #140594

Open

picnixz requested changes Nov 2, 2025

View reviewed changes

bedevere-app bot added awaiting changes and removed awaiting review labels Nov 2, 2025

picnixz changed the title ~~gh-140594: Fix buffer underflow in PyOS_StdioReadline on null bytes~~ gh-140594: Fix buffer overflow when feeding NULL bytes to PyOS_StdioReadline Nov 2, 2025

Add test for NUL byte in interactive mode

71d79ca

bedevere-app bot added awaiting change review and removed awaiting changes labels Nov 2, 2025

bedevere-app bot requested a review from picnixz November 2, 2025 16:45

picnixz requested changes Nov 2, 2025

View reviewed changes

bedevere-app bot added awaiting changes and removed awaiting change review labels Nov 2, 2025

test: refactor null byte interactive mode test to use EnvironmentVarG…

42fdcfb

…uard

ashm-dev force-pushed the asan branch from bf87683 to 42fdcfb Compare November 2, 2025 17:08

ashm-dev added 2 commits November 2, 2025 20:11

docs: improve security advisory for PyOS_StdioReadline fix

b09a4c8

test: remove unnecessary -S and -q flags from null byte test

976dedb

picnixz requested changes Nov 2, 2025

View reviewed changes

Lib/test/test_cmd_line.py Outdated Show resolved Hide resolved

Misc/NEWS.d/next/Security/2025-11-02-16-23-17.gh-issue-140594.YIWUpl.rst Outdated Show resolved Hide resolved

Lib/test/test_cmd_line.py Outdated Show resolved Hide resolved

bedevere-app bot added awaiting change review and removed awaiting changes labels Nov 2, 2025

bedevere-app bot added awaiting change review and removed awaiting changes labels Nov 3, 2025

bedevere-app bot requested a review from picnixz November 3, 2025 08:16

sergey-miryanov reviewed Nov 4, 2025

View reviewed changes

Parser/myreadline.c Show resolved Hide resolved

picnixz reviewed Nov 15, 2025

View reviewed changes

Parser/myreadline.c Show resolved Hide resolved

Merge branch 'main' into asan

11912ec

ashm-dev requested review from picnixz and sergey-miryanov November 18, 2025 19:02

sergey-miryanov requested changes Nov 18, 2025

View reviewed changes

Lib/test/test_cmd_line.py Show resolved Hide resolved

ashm-dev requested review from efimov-mikhail and sergey-miryanov November 18, 2025 20:53

python deleted a comment from ashm-dev Nov 20, 2025

ashm-dev added 2 commits November 20, 2025 19:06

Merge remote-tracking branch 'upstream/main' into asan

010a482

fix

9dbeba9

efimov-mikhail reviewed Nov 20, 2025

View reviewed changes

Lib/test/test_cmd_line.py Outdated Show resolved Hide resolved

fix comment

a982737

ashm-dev requested a review from efimov-mikhail November 20, 2025 16:27

sergey-miryanov reviewed Nov 20, 2025

View reviewed changes

Lib/test/test_cmd_line.py Outdated Show resolved Hide resolved

Misc/NEWS.d/next/Core_and_Builtins/2025-11-02-16-23-17.gh-issue-140594.YIWUpl.rst Show resolved Hide resolved

ashm-dev added 2 commits November 21, 2025 11:10

fix test docstring

6f83dc8

fix news

6ffaace

ashm-dev requested a review from sergey-miryanov November 21, 2025 08:14

Merge branch 'main' into asan

43025bd

sergey-miryanov approved these changes Nov 21, 2025

View reviewed changes

efimov-mikhail approved these changes Nov 21, 2025

View reviewed changes

vstinner reviewed Nov 28, 2025

View reviewed changes

		@@ -0,0 +1,2 @@
		Fix a buffer overflow when a single NULL character is read from the standard input.

	Fix a buffer overflow when a single NULL character is read from the standard input.
	Fix an out of bounds read when a single NUL character is read from the standard input.

	} while (n == 0 \|\| p[n-1] != '\n');
	} while (n != 0 && p[n-1] != '\n');

Uh oh!

gh-140594: Fix buffer overflow when feeding NULL bytes to PyOS_StdioReadline #140910

Are you sure you want to change the base?

gh-140594: Fix buffer overflow when feeding NULL bytes to PyOS_StdioReadline #140910

Uh oh!

Conversation

ashm-dev commented Nov 2, 2025 • edited by bedevere-app bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

picnixz left a comment

Choose a reason for hiding this comment

Uh oh!

bedevere-app bot commented Nov 2, 2025

Uh oh!

picnixz commented Nov 2, 2025

Uh oh!

ashm-dev commented Nov 2, 2025

Uh oh!

bedevere-app bot commented Nov 2, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bedevere-app bot commented Nov 2, 2025

Uh oh!

ashm-dev commented Nov 2, 2025

Uh oh!

picnixz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bedevere-app bot commented Nov 2, 2025

Uh oh!

ashm-dev commented Nov 3, 2025

Uh oh!

bedevere-app bot commented Nov 3, 2025

Uh oh!

picnixz commented Nov 3, 2025

Uh oh!

ashm-dev commented Nov 3, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

efimov-mikhail commented Nov 20, 2025

Uh oh!

Uh oh!

Uh oh!

sergey-miryanov left a comment

Choose a reason for hiding this comment

Uh oh!

efimov-mikhail left a comment

Choose a reason for hiding this comment

Uh oh!

vstinner Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

vstinner Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

sergey-miryanov Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

vstinner Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

vstinner Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

sergey-miryanov Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

efimov-mikhail Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

gh-140594: Fix buffer overflow when feeding NULL bytes to `PyOS_StdioReadline` #140910

gh-140594: Fix buffer overflow when feeding NULL bytes to `PyOS_StdioReadline` #140910

ashm-dev commented Nov 2, 2025 •

edited by bedevere-app bot

Loading