Stowage/cpython
2
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-12-08 06:10:17 +00:00
Code Issues Projects Releases Packages Wiki Activity

gh-42400: Fix buffer overflow in _Py_wrealpath() for very long paths (#141529)

Browse source 
Co-authored-by: Victor Stinner <vstinner@python.org>
This commit is contained in:
Shamil 2025-11-18 19:34:58 +03:00 • committed by GitHub
parent 600f3feb23
commit daafacf005
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 7 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Misc/NEWS.d/next/Security/2025-11-13-22-31-56.gh-issue-42400.pqB5Kq.rst Normal file
View file

@ -0,0 +1,3 @@
Fix buffer overflow in ``_Py_wrealpath()`` for paths exceeding ``MAXPATHLEN`` bytes
by using dynamic memory allocation instead of fixed-size buffer.
Patch by Shamil Abdulaev.

7
Python/fileutils.c
View file

@ -2118,7 +2118,6 @@ _Py_wrealpath(const wchar_t *path,
wchar_t *resolved_path, size_t resolved_path_len) wchar_t *resolved_path, size_t resolved_path_len)
{ {
char *cpath; char *cpath;
char cresolved_path[MAXPATHLEN];
wchar_t *wresolved_path; wchar_t *wresolved_path;
char *res; char *res;
size_t r; size_t r;
@ -2127,12 +2126,14 @@ _Py_wrealpath(const wchar_t *path,
errno = EINVAL; errno = EINVAL;
return NULL; return NULL;
} }
res = realpath(cpath, cresolved_path); res = realpath(cpath, NULL);
PyMem_RawFree(cpath); PyMem_RawFree(cpath);
if (res == NULL) if (res == NULL)
return NULL; return NULL;
wresolved_path = Py_DecodeLocale(cresolved_path, &r); wresolved_path = Py_DecodeLocale(res, &r);
free(res);
if (wresolved_path == NULL) { if (wresolved_path == NULL) {
errno = EINVAL; errno = EINVAL;
return NULL; return NULL;