Null dereferencing of a pointer in initconfig.c

Bug report

Potentially, if "value" equals NULL and "spec->type" equals "PyConfig_MEMBER_WSTR_OPT", null will be passed into "utf8_to_wstr" function and might cause a segmentation fault in strlen

cpython/Python/initconfig.c

Lines 4369 to 4376 in d3a1e72

    
           if (value == NULL && spec->type != PyConfig_MEMBER_WSTR_OPT) { 
        
               initconfig_set_error(config, "config option string cannot be NULL"); 
        
               return -1; 
        
           } 
        
           wchar_t **member = raw_member; 
        
           wchar_t *wstr = utf8_to_wstr(config, value);

cpython/Python/initconfig.c

Lines 4324 to 4328 in d3a1e72

    
           utf8_to_wstr(PyInitConfig *config, const char *str) 
        
           { 
        
               wchar_t *wstr; 
        
               size_t wlen; 
        
               int res = _Py_DecodeUTF8(str, strlen(str), &wstr, &wlen, _Py_ERROR_STRICT);

Documentation states that "value" is a null-terminated UTF-8 string, but isn't clearly stating that Null is allowed

Suggested fix: separate "value" and "spec->type" checks

if (value == NULL) { 
        if (spec->type != PyConfig_MEMBER_WSTR_OPT) {
               nitconfig_set_error(config, "config option string cannot be NULL");
               return -1;
               }
    wchar_t **member = raw_member;
    free(*member);
    *member = wstr;
    return 0;
}

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

I will work on it if maintainers approve

Hoe can a NUL-terminated UTF8 string be NULL? are other functions checking for nullity? i believe this is unnecessary churn.

@picnixz

@picnixz
It does describe "value" as a null-terminated UTF-8 string, yes, which indeed does not explicitly allow NULL

However, the implementation explicitly checks whether "value" is NULL, suggesting that NULL might have been intended to be supported at some point

@vstinner

Reproduced on main:

#include <Python.h>

int main(void)
{
    PyInitConfig *config = PyInitConfig_Create();
    return PyInitConfig_SetStr(config, "prefix", NULL);
}

#0  __strlen_avx2 ()
#1  utf8_to_wstr (config=..., str=0x0) at Python/initconfig.c:4328
#2  PyInitConfig_SetStr (config=..., name=..., value=0x0) at Python/initconfig.c:4376
#3  main ()

Original implementation (#123502) added the NULL check with an explicit exemption for PyConfig_MEMBER_WSTR_OPT, but had no return -1:

cpython/Python/initconfig.c

Lines 3809 to 3815 in ef9d547

    
           if (value == NULL && spec->type != PyConfig_MEMBER_WSTR_OPT) { 
        
               initconfig_set_error(config, "config option string cannot be NULL"); 
        
           } 
        
           wchar_t **member = raw_member; 
        
           *member = utf8_to_wstr(config, value);

It was partially fixed in #159769 (comment), but left the WSTR_OPT exemption as-is.

cc @vstinner

Navigation Menu

Repository navigation

Null dereferencing of a pointer in initconfig.c #160962

Bug report

CPython versions tested on:

Operating systems tested on:

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

	if (value == NULL && spec->type != PyConfig_MEMBER_WSTR_OPT) {
	initconfig_set_error(config, "config option string cannot be NULL");
	return -1;
	}

	wchar_t **member = raw_member;

	wchar_t *wstr = utf8_to_wstr(config, value);

	utf8_to_wstr(PyInitConfig config, const char str)
	{
	wchar_t *wstr;
	size_t wlen;
	int res = _Py_DecodeUTF8(str, strlen(str), &wstr, &wlen, _Py_ERROR_STRICT);

Null dereferencing of a pointer in initconfig.c #160962

Description

Bug report

CPython versions tested on:

Operating systems tested on:

Activity

lazerg commented on Oct 30, 2026

picnixz commented on Oct 30, 2026

Aruise commented on Oct 30, 2026

NekoAsakura commented on Oct 30, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions