Skip to content

gh-129813: Check size in PyBytesWriter_FinishWithSize() - #157226

Merged
vstinner merged 5 commits into
python:mainfrom
vstinner:writer_size
Sep 9, 2026
Merged

gh-129813: Check size in PyBytesWriter_FinishWithSize()#157226
vstinner merged 5 commits into
python:mainfrom
vstinner:writer_size

Conversation

@vstinner

@vstinner vstinner commented Sep 9, 2026

Copy link
Copy Markdown
Member

Reject size larger than the allocated size.

Also, check negative size in PyBytesWriter_FinishWithSize() to always raise ValueError. Previously, the function raised SystemError or ValueError depending on the code path.

Replace _PyBytesWriter_GetAllocated() optimization with _PyBytesWriter_ResizeToAllocated() to update the writer size to its allocated size.

Reject size larger than the allocated size.

Also, check negative size in PyBytesWriter_FinishWithSize() to always
raise ValueError. Previously, the function raised SystemError or
ValueError depending on the code path.

Replace _PyBytesWriter_GetAllocated() optimization with
_PyBytesWriter_ResizeToAllocated() to update the writer size to its
allocated size.
@vstinner vstinner added skip news needs backport to 3.15 pre-release feature fixes, bugs and security fixes labels Sep 9, 2026
@vstinner

vstinner commented Sep 9, 2026

Copy link
Copy Markdown
Member Author

Currently, if PyBytesWriter_FinishWithSize() size is larger than the writer size, it reads uninitialized memory (which can lead to a segfault) which is bad.

test_capi: only run the 3 "example" tests in BytesWriterTest. There
is no need to rerun the same tests in ByteArrayWriterTest.
FinishWithSize() already checks the size.
@vstinner
vstinner merged commit 4e530b8 into python:main Sep 9, 2026
51 checks passed
@vstinner
vstinner deleted the writer_size branch September 9, 2026 18:59
@miss-islington-app

Copy link
Copy Markdown

Thanks @vstinner for the PR 🌮🎉.. I'm working now to backport this PR to: 3.15.
🐍🍒⛏🤖

@miss-islington-app

Copy link
Copy Markdown

Sorry, @vstinner, I could not cleanly backport this to 3.15 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 4e530b82f37ec89e3b54bc5d0a1612c643bff1e0 3.15

@vstinner

vstinner commented Sep 9, 2026

Copy link
Copy Markdown
Member Author

There are conflicts on the 3.15 backport. Some recent PyBytesWriter changes are not backported to 3.15 yet. I will backport this change when the 3.15 branch will be unblocked (after 3.15.0 final release).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs backport to 3.15 pre-release feature fixes, bugs and security fixes skip news

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant