Issue #21151: Fixed a segfault in the _winreg module.

When ``None`` was passed as a ``REG_BINARY`` value to SetValueEx,
PyMem_DEL was called on an uninitialized buffer.  Patch by John Ehresman.

(Also an incidental typo fix in a comment in test_winreg)

diff --git a/Lib/test/test_winreg.py b/Lib/test/test_winreg.py
index 260c2245101f2f586d4e54aead60d797b8281957..8e3cdf3637011bf18a18e2c88b2816cffe590e7e 100644 (file)
--- a/Lib/test/test_winreg.py
+++ b/Lib/test/test_winreg.py
@@ -341,7 +341,7 @@ class LocalWinregTests(BaseWinregTests):
     def test_queryvalueex_return_value(self):
         # Test for Issue #16759, return unsigned int from QueryValueEx.
         # Reg2Py, which gets called by QueryValueEx, was returning a value
-        # generated by PyLong_FromLong. The implmentation now uses
+        # generated by PyLong_FromLong. The implementation now uses
         # PyLong_FromUnsignedLong to match DWORD's size.
         try:
             with CreateKey(HKEY_CURRENT_USER, test_key_name) as ck:
@@ -354,6 +354,19 @@ class LocalWinregTests(BaseWinregTests):
         finally:
             DeleteKey(HKEY_CURRENT_USER, test_key_name)
 
+    def test_setvalueex_crash_with_none_arg(self):
+        # Test for Issue #21151, segfault when None is passed to SetValueEx
+        try:
+            with CreateKey(HKEY_CURRENT_USER, test_key_name) as ck:
+                self.assertNotEqual(ck.handle, 0)
+                test_val = None
+                SetValueEx(ck, "test_name", 0, REG_BINARY, test_val)
+                ret_val, ret_type = QueryValueEx(ck, "test_name")
+                self.assertEqual(ret_type, REG_BINARY)
+                self.assertEqual(ret_val, test_val)
+        finally:
+            DeleteKey(HKEY_CURRENT_USER, test_key_name)
+
 
 
 @unittest.skipUnless(REMOTE_NAME, "Skipping remote registry tests")

diff --git a/Misc/NEWS b/Misc/NEWS
index 6f266ab245e6b69866cd15f9eaa9357aa19065c5..4384562db7b3ff171025939ffdc4c32753b13f90 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -13,6 +13,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #21151: Fixed a segfault in the _winreg module when ``None`` is passed
+  as a ``REG_BINARY`` value to SetValueEx.  Patch by John Ehresman.
+
 - Issue #21090: io.FileIO.readall() does not ignore I/O errors anymore. Before,
   it ignored I/O errors if at least the first C call read() succeed.
 

diff --git a/PC/_winreg.c b/PC/_winreg.c
index f90a282b5408235d8da32369cf559b5423bc0059..f757aa531053430028275521e6b3f2a23b3ccb21 100644 (file)
--- a/PC/_winreg.c
+++ b/PC/_winreg.c
@@ -883,8 +883,10 @@ Py2Reg(PyObject *value, DWORD typ, BYTE **retDataBuf, DWORD *retDataSize)
         /* ALSO handle ALL unknown data types here.  Even if we can't
            support it natively, we should handle the bits. */
         default:
-            if (value == Py_None)
+            if (value == Py_None) {
                 *retDataSize = 0;
+                *retDataBuf = NULL;
+            }
             else {
                 void *src_buf;
                 PyBufferProcs *pb = value->ob_type->tp_as_buffer;