gh-148286: Fix UB in `ZstdDecompressor.unused_data` when a frame is decompressed...

Co-authored-by: Emma Smith <emma@emmatyping.dev>

diff --git a/Misc/NEWS.d/next/Library/2026-07-07-13-31-52.gh-issue-148286.-qu-em.rst b/Misc/NEWS.d/next/Library/2026-07-07-13-31-52.gh-issue-148286.-qu-em.rst
new file mode 100644 (file)
index 0000000..60cd490
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-07-07-13-31-52.gh-issue-148286.-qu-em.rst
@@ -0,0 +1,3 @@
+Fix undefined behavior in
+:attr:`compression.zstd.ZstdDecompressor.unused_data` when a complete frame
+was decompressed in a single call.

diff --git a/Modules/_zstd/decompressor.c b/Modules/_zstd/decompressor.c
index cb95ba89eb650aee50a952ab10019b8ad4bfcbc1..ca9ea7e3b8f99bb5f45a046e1c60e63408397f54 100644 (file)
--- a/Modules/_zstd/decompressor.c
+++ b/Modules/_zstd/decompressor.c
@@ -594,9 +594,14 @@ _zstd_ZstdDecompressor_unused_data_get_impl(ZstdDecompressor *self)
     }
     else {
         if (self->unused_data == NULL) {
-            self->unused_data = PyBytes_FromStringAndSize(
-                                    self->input_buffer + self->in_begin,
-                                    self->in_end - self->in_begin);
+            if (self->input_buffer == NULL) {
+                self->unused_data = Py_GetConstant(Py_CONSTANT_EMPTY_BYTES);
+            }
+            else {
+                self->unused_data = PyBytes_FromStringAndSize(
+                                        self->input_buffer + self->in_begin,
+                                        self->in_end - self->in_begin);
+            }
             ret = self->unused_data;
             Py_XINCREF(ret);
         }

diff --git a/Tools/ubsan/suppressions.txt b/Tools/ubsan/suppressions.txt
index e3679bc421f4205abaf04503600188b1340b51e9..2b9ad49ebf1eefbce14a908ae51b4707df5b7d0f 100644 (file)
--- a/Tools/ubsan/suppressions.txt
+++ b/Tools/ubsan/suppressions.txt
@@ -15,8 +15,5 @@ shift-base:Modules/_ctypes/cfield.c
 # Modules/_ctypes/cfield.c:640:1: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
 signed-integer-overflow:Modules/_ctypes/cfield.c
 
-# Modules/_zstd/decompressor.c:598:56: runtime error: applying non-zero offset 18446744073709551615 to null pointer
-pointer-overflow:Modules/_zstd/decompressor.c
-
 # Modules/_io/stringio.c:350:24: runtime error: addition of unsigned offset to 0x7fd01ec25850 overflowed to 0x7fd01ec2584c
 pointer-overflow:Modules/_io/stringio.c