Issue #18556: Check the return value for PyUnicode_AsWideChar() in

U_set() from ctypes.

CID #486657

diff --git a/Misc/NEWS b/Misc/NEWS
index 7880adb2b70205f4a5abfdee76ac4637fef401a4..8c23a9e56bb239ec8ae3e96820ae1acf7855aac1 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -52,6 +52,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #18556: Check the return value of a PyUnicode_AsWideChar() call in
+  ctypes' U_set().
+
 - Issue #18549: Eliminate dead code in socket_ntohl()
 
 - Issue #18514: Fix unreachable Py_DECREF() call in PyCData_FromBaseObj()

diff --git a/Modules/_ctypes/cfield.c b/Modules/_ctypes/cfield.c
index f6f8e4236b125455b78de3c83b28ec2475c49f65..65772cfa45a4c5a12b99b24ce9d687e2bde17d60 100644 (file)
--- a/Modules/_ctypes/cfield.c
+++ b/Modules/_ctypes/cfield.c
@@ -1260,7 +1260,11 @@ U_set(void *ptr, PyObject *value, Py_ssize_t length)
     } else if (size < length-1)
         /* copy terminating NUL character if there is space */
         size += 1;
-    PyUnicode_AsWideChar(value, (wchar_t *)ptr, size);
+
+    if (PyUnicode_AsWideChar(value, (wchar_t *)ptr, size) == -1) {
+        return NULL;
+    }
+
     return value;
 }