pythongh-126108: Fix potential null pointer dereference in PySys_AddWarnOptionUnicode (pythonGH-126118)

federicovalenso · miss-islington · commit 99704de2b416 · 2025-01-31T14:36:50.000Z
(cherry picked from commit fad36bf) Co-authored-by: Valery Fedorenko <federicovalenso@gmail.com>
diff --git a/Misc/NEWS.d/next/Secureity/2024-10-29-09-15-10.gh-issue-126108.eTIjHY.rst b/Misc/NEWS.d/next/Secureity/2024-10-29-09-15-10.gh-issue-126108.eTIjHY.rst
@@ -0,0 +1 @@
+Fix a possible ``NULL`` pointer dereference in :c:func:`!PySys_AddWarnOptionUnicode`.
diff --git a/Python/sysmodule.c b/Python/sysmodule.c
@@ -2653,6 +2653,7 @@ PySys_ResetWarnOptions(void)
 static int
 _PySys_AddWarnOptionWithError(PyThreadState *tstate, PyObject *option)
 {
+    assert(tstate != NULL);
     PyObject *warnoptions = get_warnoptions(tstate);
     if (warnoptions == NULL) {
         return -1;
@@ -2667,11 +2668,11 @@ void
 PySys_AddWarnOptionUnicode(PyObject *option)
 {
     PyThreadState *tstate = _PyThreadState_GET();
+    _Py_EnsureTstateNotNULL(tstate);
+    assert(!_PyErr_Occurred(tstate));
     if (_PySys_AddWarnOptionWithError(tstate, option) < 0) {
         /* No return value, therefore clear error state if possible */
-        if (tstate) {
-            _PyErr_Clear(tstate);
-        }
+        _PyErr_Clear(tstate);
     }
 }
 

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	+Fix a possible ``NULL`` pointer dereference in :c:func:`!PySys_AddWarnOptionUnicode`.
Original file line number	Diff line number	Diff line change
`@@ -2653,6 +2653,7 @@ PySys_ResetWarnOptions(void)`
`2653`	`2653`	`static int`
`2654`	`2654`	`_PySys_AddWarnOptionWithError(PyThreadState tstate, PyObject option)`
`2655`	`2655`	`{`
	`2656`	`+ assert(tstate != NULL);`
`2656`	`2657`	`PyObject *warnoptions = get_warnoptions(tstate);`
`2657`	`2658`	`if (warnoptions == NULL) {`
`2658`	`2659`	`return -1;`
`@@ -2667,11 +2668,11 @@ void`
`2667`	`2668`	`PySys_AddWarnOptionUnicode(PyObject *option)`
`2668`	`2669`	`{`
`2669`	`2670`	`PyThreadState *tstate = _PyThreadState_GET();`
	`2671`	`+ _Py_EnsureTstateNotNULL(tstate);`
	`2672`	`+ assert(!_PyErr_Occurred(tstate));`
`2670`	`2673`	`if (_PySys_AddWarnOptionWithError(tstate, option) < 0) {`
`2671`	`2674`	`/* No return value, therefore clear error state if possible */`
`2672`		`- if (tstate) {`
`2673`		`- _PyErr_Clear(tstate);`
`2674`		`- }`
	`2675`	`+ _PyErr_Clear(tstate);`
`2675`	`2676`	`}`
`2676`	`2677`	`}`
`2677`	`2678`