gh-140594: Fix buffer overflow when feeding NULL bytes to PyOS_StdioReadline

Lib/test/test_cmd_line.py

@@ -201,6 +201,27 @@ def test_run_module_bug1764407(self):
         self.assertTrue(data.find(b'1 loop') != -1)
         self.assertTrue(data.find(b'__main__.Timer') != -1)
 
+    @support.cpython_only
+    def test_null_byte_in_interactive_mode(self):
+        # gh-140594: heap-buffer-underflow в PyOS_StdioReadline при \0 в интерактивном вводе
+        env = os.environ.copy()
+        env.pop('PYTHONSTARTUP', None)
+        args = [sys.executable, '-I', '-S', '-q', '-i']
+        p = subprocess.Popen(
+            args,
+            stdin=subprocess.PIPE,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT,
+        )
+        out, _ = p.communicate(b'\x00', timeout=10)
+        self.assertEqual(
+            p.returncode, 0,
+            msg=f"Interpreter aborted on NUL input, output:\n{out[:500]!r}"
+        )
+        if out:
+            self.assertNotIn(b'AddressSanitizer', out)
+            self.assertNotIn(b'ERROR:', out)
+
     def test_relativedir_bug46421(self):
         # Test `python -m unittest` with a relative directory beginning with ./
         # Note: We have to switch to the project's top module's directory, as per

Misc/NEWS.d/next/Security/2025-11-02-16-23-17.gh-issue-140594.YIWUpl.rst

@@ -0,0 +1,2 @@
+Fixed heap-buffer-overflow in PyOS_StdioReadline when encountering null
+bytes in interactive input. Patch by Shamil Abdulaev.

Parser/myreadline.c

@@ -344,7 +344,7 @@ PyOS_StdioReadline(FILE *sys_stdin, FILE *sys_stdout, const char *prompt)
             break;
         }
         n += strlen(p + n);
-    } while (p[n-1] != '\n');
+    } while (n > 0 && p[n-1] != '\n');
 
     pr = (char *)PyMem_RawRealloc(p, n+1);
     if (pr == NULL) {