From ddcf7e4d6290fa607c15754fb2ff900941f2d461 Mon Sep 17 00:00:00 2001 From: dr-carlos Date: Fri, 28 Nov 2025 16:39:13 +1030 Subject: [PATCH 1/5] Check that `name` is non-empty in `_imp.create_builtin()` --- Python/import.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Python/import.c b/Python/import.c index e91c95b40d94bf..e123e9665fe1a4 100644 --- a/Python/import.c +++ b/Python/import.c @@ -4420,6 +4420,13 @@ _imp_create_builtin(PyObject *module, PyObject *spec) return NULL; } + if (PyUnicode_GetLength(name) == 0) { + PyErr_Format(PyExc_TypeError, + "name must not be empty"); + Py_DECREF(name); + return NULL; + } + PyObject *mod = create_builtin(tstate, name, spec, NULL); Py_DECREF(name); return mod; From 901b039c924f33f656e67825dca74d1691e0cc7e Mon Sep 17 00:00:00 2001 From: dr-carlos Date: Fri, 28 Nov 2025 16:53:51 +1030 Subject: [PATCH 2/5] Edit NEWS entry --- .../2025-11-28-16-45-07.gh-issue-142029.JuXiKu.rst | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2025-11-28-16-45-07.gh-issue-142029.JuXiKu.rst diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2025-11-28-16-45-07.gh-issue-142029.JuXiKu.rst b/Misc/NEWS.d/next/Core_and_Builtins/2025-11-28-16-45-07.gh-issue-142029.JuXiKu.rst new file mode 100644 index 00000000000000..b247d3a166f776 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2025-11-28-16-45-07.gh-issue-142029.JuXiKu.rst @@ -0,0 +1,2 @@ +Raise :exc:`TypeError` instead of crashing when empty string is used as a +name in :func:`importlib._imp.create_builtin`. From 784c232286fcd9fac7a498115413ac9b8608457e Mon Sep 17 00:00:00 2001 From: dr-carlos Date: Fri, 28 Nov 2025 17:00:00 +1030 Subject: [PATCH 3/5] Don't use `:func:` in NEWS for undocumented function --- .../2025-11-28-16-45-07.gh-issue-142029.JuXiKu.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2025-11-28-16-45-07.gh-issue-142029.JuXiKu.rst b/Misc/NEWS.d/next/Core_and_Builtins/2025-11-28-16-45-07.gh-issue-142029.JuXiKu.rst index b247d3a166f776..962589dd3543a4 100644 --- a/Misc/NEWS.d/next/Core_and_Builtins/2025-11-28-16-45-07.gh-issue-142029.JuXiKu.rst +++ b/Misc/NEWS.d/next/Core_and_Builtins/2025-11-28-16-45-07.gh-issue-142029.JuXiKu.rst @@ -1,2 +1,2 @@ Raise :exc:`TypeError` instead of crashing when empty string is used as a -name in :func:`importlib._imp.create_builtin`. +name in ``importlib._imp.create_builtin``. From 5102f3d5b2e8e5091a39801b300c6950fb957b35 Mon Sep 17 00:00:00 2001 From: dr-carlos Date: Sat, 29 Nov 2025 07:44:23 +1030 Subject: [PATCH 4/5] Update function name in NEWS entry --- .../2025-11-28-16-45-07.gh-issue-142029.JuXiKu.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2025-11-28-16-45-07.gh-issue-142029.JuXiKu.rst b/Misc/NEWS.d/next/Core_and_Builtins/2025-11-28-16-45-07.gh-issue-142029.JuXiKu.rst index 962589dd3543a4..f64fa9a18fd561 100644 --- a/Misc/NEWS.d/next/Core_and_Builtins/2025-11-28-16-45-07.gh-issue-142029.JuXiKu.rst +++ b/Misc/NEWS.d/next/Core_and_Builtins/2025-11-28-16-45-07.gh-issue-142029.JuXiKu.rst @@ -1,2 +1,2 @@ Raise :exc:`TypeError` instead of crashing when empty string is used as a -name in ``importlib._imp.create_builtin``. +name in ``_imp.create_builtin()``. From 035017723744d2a0ec96855d752e3a5942cc0a47 Mon Sep 17 00:00:00 2001 From: dr-carlos Date: Sat, 29 Nov 2025 07:50:59 +1030 Subject: [PATCH 5/5] Add simple tests for `create_builtin()` --- Lib/test/test_import/__init__.py | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/Lib/test/test_import/__init__.py b/Lib/test/test_import/__init__.py index 271361ae816449..a0b859ac28414f 100644 --- a/Lib/test/test_import/__init__.py +++ b/Lib/test/test_import/__init__.py @@ -1253,6 +1253,28 @@ class Spec2: origin = "a\x00b" _imp.create_dynamic(Spec2()) + def test_create_builtin(self): + class Spec: + name = None + spec = Spec() + + with self.assertRaisesRegex( + TypeError, + 'name must be string, not NoneType' + ): + _imp.create_builtin(spec) + + class Spec: + name = "" + spec = Spec() + + # gh-142029 + with self.assertRaisesRegex( + TypeError, + 'name must not be empty' + ): + _imp.create_builtin(spec) + def test_filter_syntax_warnings_by_module(self): module_re = r'test\.test_import\.data\.syntax_warnings\z' unload('test.test_import.data.syntax_warnings')