Skip to content

Use of uninitialized pointer in Argument Clinic generated code #97728

Closed
@serhiy-storchaka

Description

@serhiy-storchaka

The code generated for the Py_UNICODE converter (and derived converter LPCWSTR) looks like:

const Py_UNICODE *name;
...
if (!_PyArg_ParseXXX(..., name, ...)) {
    goto exit;
}
...
exit:
    PyMem_Free((void *)name);

If parsing fails, PyMem_Free() is called for uninitialized variable.

It is the only converter with non-trivial cleanup which does not have a mandatory initializer.

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.10only security fixes3.11only security fixes3.12only security fixesOS-windowstopic-argument-clinictype-bugAn unexpected behavior, bug, or errortype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions