From: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Date: Tue, 26 May 2020 09:16:36 +0000 (-0700)
Subject: [3.8] bpo-35714: Reject null characters in struct format strings (GH-16928) (GH-20419)
X-Git-Tag: v3.7.8rc1~40
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4ea802868460fad54e40cb99eb0ca283b3b293f0;p=thirdparty%2FPython%2Fcpython.git

[3.8] bpo-35714: Reject null characters in struct format strings (GH-16928) (GH-20419)


struct.error is now raised if there is a null character in a struct
format string.
(cherry picked from commit 3f59b55316f4c6ab451997902579aa69020b537c)
(cherry picked from commit 5ff5edfef63b3dbc1abb004b3fa4b3db87e79ff9)

Co-authored-by: Zackery Spytz <zspytz@gmail.com>
---

diff --git a/Lib/test/test_struct.py b/Lib/test/test_struct.py
index 8fd56c91cb7a..104f4d30c9e1 100644
--- a/Lib/test/test_struct.py
+++ b/Lib/test/test_struct.py
@@ -626,6 +626,13 @@ class StructTest(unittest.TestCase):
         s2 = struct.Struct(s.format.encode())
         self.assertEqual(s2.format, s.format)
 
+    def test_issue35714(self):
+        # Embedded null characters should not be allowed in format strings.
+        for s in '\0', '2\0i', b'\0':
+            with self.assertRaisesRegex(struct.error,
+                                        'embedded null character'):
+                struct.calcsize(s)
+
 
 class UnpackIteratorTest(unittest.TestCase):
     """
diff --git a/Misc/NEWS.d/next/Library/2019-10-25-23-45-49.bpo-35714.fw3xb7.rst b/Misc/NEWS.d/next/Library/2019-10-25-23-45-49.bpo-35714.fw3xb7.rst
new file mode 100644
index 000000000000..39102065ca7b
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2019-10-25-23-45-49.bpo-35714.fw3xb7.rst
@@ -0,0 +1,2 @@
+:exc:`struct.error` is now raised if there is a null character in a
+:mod:`struct` format string.
diff --git a/Modules/_struct.c b/Modules/_struct.c
index c09951dcb79f..4bde0ce9f065 100644
--- a/Modules/_struct.c
+++ b/Modules/_struct.c
@@ -1285,6 +1285,10 @@ prepare_s(PyStructObject *self)
     size_t ncodes;
 
     fmt = PyBytes_AS_STRING(self->s_format);
+    if (strlen(fmt) != (size_t)PyBytes_GET_SIZE(self->s_format)) {
+        PyErr_SetString(StructError, "embedded null character");
+        return -1;
+    }
 
     f = whichtable(&fmt);