Null dereferencing of a pointer in initconfig.c
Maintainers usually reply within 1 day
@lazerg is already working on this.
Since Oct 30, 2026.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Domain
- api, backend-api-design
Research direction
Start at the two linked locations in Python/initconfig.c and compare the handling of NULL values with the PyConfig_MEMBER_WSTR_OPT case. Check the C API documentation in Doc/c-api/init_config.rst, then verify that the behavior matches its contract and that the relevant configuration tests pass.
Written by the indexing model from the issue text.
Description
Bug report
Potentially, if "value" equals NULL and "spec->type" equals "PyConfig_MEMBER_WSTR_OPT", null will be passed into "utf8_to_wstr" function and might cause a segmentation fault in strlen
https://github.com/python/cpython/blob/d3a1e7280bd74a16c5822cff9c77fa28da4d725e/Python/initconfig.c#L4369-L4376
https://github.com/python/cpython/blob/d3a1e7280bd74a16c5822cff9c77fa28da4d725e/Python/initconfig.c#L4324-L4328
Documentation states that "value" is a null-terminated UTF-8 string, but isn't clearly stating that Null is allowed
Suggested fix: separate "value" and "spec->type" checks
if (value == NULL) {
if (spec->type != PyConfig_MEMBER_WSTR_OPT) {
nitconfig_set_error(config, "config option string cannot be NULL");
return -1;
}
wchar_t **member = raw_member;
free(*member);
*member = wstr;
return 0;
}
CPython versions tested on:
CPython main branch
Operating systems tested on:
No response
- Dominant language
- Python
- Stars
- 77.8k
- Forks
- 37.7k
- Avg merge
- 11h 25m
- Merged PRs (30d)
- 723
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from python/cpython
-
tests topic-profiling type-bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
python/cpython#160881 · 1 comment ·
Maintainers usually reply within 1 day
-
3.16 build pending type-bug
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
python/cpython#160829 · 5 comments ·
Maintainers usually reply within 1 day
-
dependencies infra topic-ensurepip
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
Maintainers usually reply within 1 day
-
symtable: repr() of a Symbol raises TypeError under -X lazy_imports=allPossibly taken @anistark claimed this 2 days ago. Openstdlib topic-lazy-imports type-bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
python/cpython#160810 · 4 comments ·
Maintainers usually reply within 1 day
-
tarfile: extractfile(member).read() of a sparse member is slow due to repeated bytes concatenationPossibly taken @devdavidejesus claimed this 2 days ago. Openperformance stdlib triaged type-bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
python/cpython#160774 · 2 comments · 1 assignee ·
Maintainers usually reply within 1 day
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
namespace operations
Difficulty 1/5 Under an hour Newbie friendliness 65/100
EclipseFdn/open-vsx.org#15057 ·
Maintainers usually reply within 1 day
-
Mission statement: why this is free, in the README, Why This Exists and the wiki HomePossibly taken @ChiefGyk3D claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
ChiefGyk3D/Clouds-Against-Humanity#348 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
vllm-project/vime#508 ·
Maintainers usually reply within 4 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day