From: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Date: Mon, 20 Jul 2026 08:15:34 +0000 (+0200)
Subject: [3.15] gh-154176: Fix locale.strxfrm() crash on DragonFly BSD (GH-154177) (GH-154217)
X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=2e4a1fa41dab372af40aa886079b14d61db42c98;p=thirdparty%2FPython%2Fcpython.git

[3.15] gh-154176: Fix locale.strxfrm() crash on DragonFly BSD (GH-154177) (GH-154217)

Query the result size with a real one-element buffer instead of
wcsxfrm(NULL, s, 0): DragonFly BSD's wcsxfrm() crashes when the
destination is NULL or the size is 0.
(cherry picked from commit f389b03f9f2768342bfd49987a257460d4aa4faf)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---

diff --git a/Misc/NEWS.d/next/Library/2026-07-19-21-30-00.gh-issue-154176.strxfrm.rst b/Misc/NEWS.d/next/Library/2026-07-19-21-30-00.gh-issue-154176.strxfrm.rst
new file mode 100644
index 000000000000..9ffa58280001
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-07-19-21-30-00.gh-issue-154176.strxfrm.rst
@@ -0,0 +1,2 @@
+Fix a crash in :func:`locale.strxfrm` on DragonFly BSD,
+whose ``wcsxfrm()`` does not support the zero size.
diff --git a/Modules/_localemodule.c b/Modules/_localemodule.c
index 8f7d662b00b2..35fbcd000459 100644
--- a/Modules/_localemodule.c
+++ b/Modules/_localemodule.c
@@ -443,6 +443,7 @@ _locale_strxfrm_impl(PyObject *module, PyObject *str)
 {
     Py_ssize_t n1;
     wchar_t *s = NULL, *buf = NULL;
+    wchar_t dummy[1];
     size_t n2;
     PyObject *result = NULL;
 
@@ -456,7 +457,9 @@ _locale_strxfrm_impl(PyObject *module, PyObject *str)
     }
 
     errno = 0;
-    n2 = wcsxfrm(NULL, s, 0);
+    /* Query the size with a real one-element buffer: DragonFly BSD's
+       wcsxfrm() crashes when the destination is NULL or the size is 0. */
+    n2 = wcsxfrm(dummy, s, 1);
     if (errno && errno != ERANGE) {
         PyErr_SetFromErrno(PyExc_OSError);
         goto exit;