gh-102281: Fix potential nullptr dereference + use of uninitialized memory (gh-102282)

maxbachmann · web-flow · commit afa6092ee426 · 2023-03-15T21:58:43.000+09:00
diff --git a/Misc/NEWS.d/next/Core and Builtins/2023-03-02-13-49-21.gh-issue-102281.QCuu2N.rst b/Misc/NEWS.d/next/Core and Builtins/2023-03-02-13-49-21.gh-issue-102281.QCuu2N.rst
@@ -0,0 +1 @@
+Fix potential nullptr dereference and use of uninitialized memory in fileutils. Patch by Max Bachmann.
diff --git a/Modules/getpath.c b/Modules/getpath.c
@@ -446,7 +446,10 @@ getpath_realpath(PyObject *Py_UNUSED(self) , PyObject *args)
             if (s) {
                 *s = L'\0';
             }
-            path2 = _Py_normpath(_Py_join_relfile(path, resolved), -1);
+            path2 = _Py_join_relfile(path, resolved);
+            if (path2) {
+                path2 = _Py_normpath(path2, -1);
+            }
             PyMem_RawFree((void *)path);
             path = path2;
         }
diff --git a/Python/fileutils.c b/Python/fileutils.c
@@ -2233,7 +2233,10 @@ _Py_join_relfile(const wchar_t *dirname, const wchar_t *relfile)
     }
     assert(wcslen(dirname) < MAXPATHLEN);
     assert(wcslen(relfile) < MAXPATHLEN - wcslen(dirname));
-    join_relfile(filename, bufsize, dirname, relfile);
+    if (join_relfile(filename, bufsize, dirname, relfile) < 0) {
+        PyMem_RawFree(filename);
+        return NULL;
+    }
     return filename;
 }
 
@@ -2271,6 +2274,7 @@ _Py_find_basename(const wchar_t *filename)
 wchar_t *
 _Py_normpath(wchar_t *path, Py_ssize_t size)
 {
+    assert(path != NULL);
     if (!path[0] || size == 0) {
         return path;
     }

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+Fix potential nullptr dereference and use of uninitialized memory in fileutils. Patch by Max Bachmann.`
Original file line number	Diff line number	Diff line change
`@@ -446,7 +446,10 @@ getpath_realpath(PyObject Py_UNUSED(self) , PyObject args)`
`446`	`446`	`if (s) {`
`447`	`447`	`*s = L'\0';`
`448`	`448`	`}`
`449`		`- path2 = _Py_normpath(_Py_join_relfile(path, resolved), -1);`
	`449`	`+ path2 = _Py_join_relfile(path, resolved);`
	`450`	`+ if (path2) {`
	`451`	`+ path2 = _Py_normpath(path2, -1);`
	`452`	`+ }`
`450`	`453`	`PyMem_RawFree((void *)path);`
`451`	`454`	`path = path2;`
`452`	`455`	`}`
Original file line number	Diff line number	Diff line change
`@@ -2233,7 +2233,10 @@ _Py_join_relfile(const wchar_t dirname, const wchar_t relfile)`
`2233`	`2233`	`}`
`2234`	`2234`	`assert(wcslen(dirname) < MAXPATHLEN);`
`2235`	`2235`	`assert(wcslen(relfile) < MAXPATHLEN - wcslen(dirname));`
`2236`		`- join_relfile(filename, bufsize, dirname, relfile);`
	`2236`	`+ if (join_relfile(filename, bufsize, dirname, relfile) < 0) {`
	`2237`	`+ PyMem_RawFree(filename);`
	`2238`	`+ return NULL;`
	`2239`	`+ }`
`2237`	`2240`	`return filename;`
`2238`	`2241`	`}`
`2239`	`2242`
`@@ -2271,6 +2274,7 @@ _Py_find_basename(const wchar_t *filename)`
`2271`	`2274`	`wchar_t *`
`2272`	`2275`	`_Py_normpath(wchar_t *path, Py_ssize_t size)`
`2273`	`2276`	`{`
	`2277`	`+ assert(path != NULL);`
`2274`	`2278`	`if (!path[0] \|\| size == 0) {`
`2275`	`2279`	`return path;`
`2276`	`2280`	`}`