Issue #15732: Fix (constructed) crash in _PySequence_BytesToCharpArray().

Found by Coverity.

diff --git a/Lib/test/test_capi.py b/Lib/test/test_capi.py
index c2c633ff5dd76947aa158f4dcf56340656f66b11..0307394eb42f18d6709238bd2a2939701aaa096a 100644 (file)
--- a/Lib/test/test_capi.py
+++ b/Lib/test/test_capi.py
@@ -10,6 +10,10 @@ import sys
 import time
 import unittest
 from test import support
+try:
+    import _posixsubprocess
+except ImportError:
+    _posixsubprocess = None
 try:
     import threading
 except ImportError:
@@ -55,6 +59,15 @@ class CAPITest(unittest.TestCase):
     def test_memoryview_from_NULL_pointer(self):
         self.assertRaises(ValueError, _testcapi.make_memoryview_from_NULL_pointer)
 
+    @unittest.skipUnless(_posixsubprocess, '_posixsubprocess required for this test.')
+    def test_seq_bytes_to_charp_array(self):
+        # Issue #15732: crash in _PySequence_BytesToCharpArray()
+        class Z(object):
+            def __len__(self):
+                return 1
+        self.assertRaises(TypeError, _posixsubprocess.fork_exec,
+                          1,Z(),3,[1, 2],5,6,7,8,9,10,11,12,13,14,15,16,17)
+
 @unittest.skipUnless(threading, 'Threading required for this test.')
 class TestPendingCalls(unittest.TestCase):
 

diff --git a/Objects/abstract.c b/Objects/abstract.c
index 2f887aa0563796bb9422f2c05b6697687508db4b..299daf549ef667f77173837211fefa261fbdfc31 100644 (file)
--- a/Objects/abstract.c
+++ b/Objects/abstract.c
@@ -2736,6 +2736,11 @@ _PySequence_BytesToCharpArray(PyObject* self)
     for (i = 0; i < argc; ++i) {
         char *data;
         item = PySequence_GetItem(self, i);
+        if (item == NULL) {
+            /* NULL terminate before freeing. */
+            array[i] = NULL;
+            goto fail;
+        }
         data = PyBytes_AsString(item);
         if (data == NULL) {
             /* NULL terminate before freeing. */