Null dereferencing of a pointer in initconfig.c

Bug report

Potentially, if "value" equals NULL and "spec->type" equals "PyConfig_MEMBER_WSTR_OPT", null will be passed into "utf8_to_wstr" function and might cause a segmentation fault in strlen

cpython/Python/initconfig.c

Lines 4369 to 4376 in d3a1e72

    
           if (value == NULL && spec->type != PyConfig_MEMBER_WSTR_OPT) { 
        
               initconfig_set_error(config, "config option string cannot be NULL"); 
        
               return -1; 
        
           } 
        
           wchar_t **member = raw_member; 
        
           wchar_t *wstr = utf8_to_wstr(config, value);

cpython/Python/initconfig.c

Lines 4324 to 4328 in d3a1e72

    
           utf8_to_wstr(PyInitConfig *config, const char *str) 
        
           { 
        
               wchar_t *wstr; 
        
               size_t wlen; 
        
               int res = _Py_DecodeUTF8(str, strlen(str), &wstr, &wlen, _Py_ERROR_STRICT);

Documentation states that "value" is a null-terminated UTF-8 string, but isn't clearly stating that Null is allowed

Suggested fix: separate "value" and "spec->type" checks

if (value == NULL) { 
        if (spec->type != PyConfig_MEMBER_WSTR_OPT) {
               nitconfig_set_error(config, "config option string cannot be NULL");
               return -1;
               }
    wchar_t **member = raw_member;
    free(*member);
    *member = wstr;
    return 0;
}

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs

I will work on it if maintainers approve

How can a NUL-terminated UTF8 string be NULL? are other functions checking for nullity? i believe this is unnecessary churn.

@picnixz

@picnixz
It does describe "value" as a null-terminated UTF-8 string, yes, which indeed does not explicitly allow NULL

However, the implementation explicitly checks whether "value" is NULL, suggesting that NULL might have been intended to be supported at some point

@vstinner

Reproduced on main:

#include <Python.h>

int main(void)
{
    PyInitConfig *config = PyInitConfig_Create();
    return PyInitConfig_SetStr(config, "prefix", NULL);
}

#0  __strlen_avx2 ()
#1  utf8_to_wstr (config=..., str=0x0) at Python/initconfig.c:4328
#2  PyInitConfig_SetStr (config=..., name=..., value=0x0) at Python/initconfig.c:4376
#3  main ()

Original implementation (#123502) added the NULL check with an explicit exemption for PyConfig_MEMBER_WSTR_OPT, but had no return -1:

cpython/Python/initconfig.c

Lines 3809 to 3815 in ef9d547

    
           if (value == NULL && spec->type != PyConfig_MEMBER_WSTR_OPT) { 
        
               initconfig_set_error(config, "config option string cannot be NULL"); 
        
           } 
        
           wchar_t **member = raw_member; 
        
           *member = utf8_to_wstr(config, value);

It was partially fixed in #159769 (comment), but left the WSTR_OPT exemption as-is.

cc @vstinner

This was fixed in 395d766

10. This was fixed in 395d766

That only fixed the non-WSTR_OPT path.

pythongh-160962: Fix PyInitConfig_SetStr() with NULL value

Hi. I wrote #161258 to fix PyInitConfig_SetStr() crash when the value is NULL. The PR also adds multiple tests on all Get functions.

gh-160962: Fix PyInitConfig_SetStr() with NULL value (#161258)

[3.15] gh-160962: Fix PyInitConfig_SetStr() with NULL value (GH-161258)…

[3.14] gh-160962: Fix PyInitConfig_SetStr() with NULL value (GH-161258)…

Thanks for the bug report, I merged my fix.

Navigation Menu

Repository navigation

Null dereferencing of a pointer in initconfig.c #160962

Bug report

CPython versions tested on:

Operating systems tested on:

Linked PRs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

	if (value == NULL && spec->type != PyConfig_MEMBER_WSTR_OPT) {
	initconfig_set_error(config, "config option string cannot be NULL");
	return -1;
	}

	wchar_t **member = raw_member;

	wchar_t *wstr = utf8_to_wstr(config, value);

	utf8_to_wstr(PyInitConfig config, const char str)
	{
	wchar_t *wstr;
	size_t wlen;
	int res = _Py_DecodeUTF8(str, strlen(str), &wstr, &wlen, _Py_ERROR_STRICT);

Null dereferencing of a pointer in initconfig.c #160962

Description

Bug report

CPython versions tested on:

Operating systems tested on:

Linked PRs

Activity

lazerg commented on Oct 30, 2026

picnixz commented on Oct 30, 2026

Aruise commented on Oct 30, 2026

NekoAsakura commented on Oct 30, 2026

sobolevn commented on Nov 3, 2026

NekoAsakura commented on Nov 3, 2026

vstinner commented on Nov 3, 2026

vstinner commented on Nov 4, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions