gh-140594: Fix an out of bounds read when feeding NUL byte to PyOS_StdioReadline...

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
Co-authored-by: Victor Stinner <vstinner@python.org>

diff --git a/Lib/test/test_cmd_line.py b/Lib/test/test_cmd_line.py
index 55e5f06c8071ea2cd3d6adc64455be80021120d3..e106ac20809f20821570056cdbc1cd70bf9d6e8b 100644 (file)
--- a/Lib/test/test_cmd_line.py
+++ b/Lib/test/test_cmd_line.py
@@ -200,6 +200,14 @@ class CmdLineTest(unittest.TestCase):
         self.assertTrue(data.find(b'1 loop') != -1)
         self.assertTrue(data.find(b'__main__.Timer') != -1)
 
+    @support.cpython_only
+    def test_null_byte_in_interactive_mode(self):
+        # gh-140594: Fix an out of bounds read when a single NUL character
+        # is read from the standard input in interactive mode.
+        proc = spawn_python('-i')
+        proc.communicate(b'\x00', timeout=support.SHORT_TIMEOUT)
+        self.assertEqual(proc.returncode, 0)
+
     def test_relativedir_bug46421(self):
         # Test `python -m unittest` with a relative directory beginning with ./
         # Note: We have to switch to the project's top module's directory, as per

diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2025-11-02-16-23-17.gh-issue-140594.YIWUpl.rst b/Misc/NEWS.d/next/Core_and_Builtins/2025-11-02-16-23-17.gh-issue-140594.YIWUpl.rst
new file mode 100644 (file)
index 0000000..aa126e7
--- /dev/null
+++ b/Misc/NEWS.d/next/Core_and_Builtins/2025-11-02-16-23-17.gh-issue-140594.YIWUpl.rst
@@ -0,0 +1,2 @@
+Fix an out of bounds read when a single NUL character is read from the standard input.
+Patch by Shamil Abdulaev.

diff --git a/Parser/myreadline.c b/Parser/myreadline.c
index 64e8f5383f06022836dd8d695c5d5db9b825cddc..ee77479ba7bdccbd0327ba7904b4f2b37d16ce7f 100644 (file)
--- a/Parser/myreadline.c
+++ b/Parser/myreadline.c
@@ -344,7 +344,7 @@ PyOS_StdioReadline(FILE *sys_stdin, FILE *sys_stdout, const char *prompt)
             break;
         }
         n += strlen(p + n);
-    } while (p[n-1] != '\n');
+    } while (n == 0 || p[n-1] != '\n');
 
     pr = (char *)PyMem_RawRealloc(p, n+1);
     if (pr == NULL) {