Re: [Libguestfs] [PATCH] RHBZ#1406906: check return value of Python object functions

Verify the returned values of Python Object constructor functions are not NULL before adding them to a collection. This is particularly relevant when constructing Unicode strings in Python 3 as they will return NULL if non UTF-8 characters are present. Signed-off-by: Matteo Cafasso <noxdafox(a)gmail.com&gt; ---

diff --git a/python/handle.c b/python/handle.c index 88024e184..fa6578034 100644 --- a/python/handle.c +++ b/python/handle.c @@ -341,21 +349,35 @@ guestfs_int_py_put_string_list (char * const * const argv) PyObject * guestfs_int_py_put_table (char * const * const argv) { - PyObject *list, *item; + PyObject *list, *tuple, *item; size_t argc, i; for (argc = 0; argv[argc] != NULL; ++argc) ; list = PyList_New (argc >> 1); + if (list == NULL) + return NULL; for (i = 0; i < argc; i += 2) { - item = PyTuple_New (2); - PyTuple_SetItem (item, 0, guestfs_int_py_fromstring (argv[i])); - PyTuple_SetItem (item, 1, guestfs_int_py_fromstring (argv[i+1])); + tuple = PyTuple_New (2); + if (tuple == NULL) + goto err; + item = guestfs_int_py_fromstring (argv[i]); + if (item == NULL) + goto err; + PyTuple_SetItem (tuple, 0, item); + item = guestfs_int_py_fromstring (argv[i+1]); + if (item == NULL) + goto err; + PyTuple_SetItem (tuple, 1, item); PyList_SetItem (list, i >> 1, item);

diff --git a/python/t/test830RHBZ1406906.py b/python/t/test830RHBZ1406906.py new file mode 100644 index 000000000..6cef982f9 --- /dev/null +++ b/python/t/test830RHBZ1406906.py @@ -0,0 +1,51 @@ +# libguestfs Python bindings +# Copyright (C) 2017 Red Hat Inc. +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + +import os +import sys +import shutil +import tempfile +import unittest + +import guestfs + + +class Test830RHBZ1406906(unittest.TestCase): + def setUp(self): + self.tempdir = tempfile.mkdtemp() + + def tearDown(self): + shutil.rmtree(self.tempdir) + + def test_rhbz1406906(self): + g = guestfs.GuestFS(python_return_dict=True) + + g.add_drive_scratch(512 * 1024 * 1024) + g.launch() + + g.part_disk("/dev/sda", "mbr") + g.mkfs("ext4", "/dev/sda1") + g.mount("/dev/sda1", "/") + + # touch file with illegal unicode character + open(os.path.join(self.tempdir, "\udcd4"), "w").close() + + g.copy_in(self.tempdir, "/") + + if sys.version_info.major == 3:

+ with self.assertRaises(UnicodeDecodeError): + g.find("/") # segfault here on Python 3