_testcapi.pymem_buffer_overflow() doesn't handle memory allocation failure

[wjq-security]

BPO	36436
Nosy	@vstinner, @serhiy-storchaka, @miss-islington, @tirkarthi
PRs	bpo-36436: Fix _testcapi.pymem_buffer_overflow() #12560 [3.7] bpo-36436: Fix _testcapi.pymem_buffer_overflow() (GH-12560) #12561 [3.7] bpo-36436: Fix _testcapi.pymem_buffer_overflow() (GH-12560) #12564

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2019-03-26.18:35:36.822>
created_at = <Date 2019-03-26.12:35:32.977>
labels = ['3.8', '3.7', 'tests']
title = "_testcapi.pymem_buffer_overflow() doesn't handle memory allocation failure"
updated_at = <Date 2019-03-26.18:35:36.821>
user = 'https://bugs.python.org/wjq-security'

bugs.python.org fields:

activity = <Date 2019-03-26.18:35:36.821>
actor = 'vstinner'
assignee = 'none'
closed = True
closed_date = <Date 2019-03-26.18:35:36.822>
closer = 'vstinner'
components = ['Tests']
creation = <Date 2019-03-26.12:35:32.977>
creator = 'wjq-security'
dependencies = []
files = []
hgrepos = []
issue_num = 36436
keywords = ['patch']
message_count = 6.0
messages = ['338875', '338878', '338880', '338888', '338898', '338912']
nosy_count = 5.0
nosy_names = ['vstinner', 'serhiy.storchaka', 'miss-islington', 'xtreak', 'wjq-security']
pr_nums = ['12560', '12561', '12564']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue36436'
versions = ['Python 3.7', 'Python 3.8']

[wjq-security]

In Modules/_testcapimodule.c line 4186 and 4187.
Allocated memory is used without null check.

[tirkarthi]

_testcapimodule.c is mostly imported as _testcapi in tests. I am not sure this is a security issue.

[vstinner]

_testcapimodule.c is mostly imported as _testcapi in tests. I am not sure this is a security issue.

The function triggers a memory overflow on purpose. Handling memory allocation failure is the least of your problem if you call this function :-)

The whole module is designed to testing purpose only. "_" prefix in "_testapi" means that it must not be used. It's not documented on purpose.

Attached PR fix the bug.

[vstinner]

New changeset 414b1cd by Victor Stinner in branch 'master':
bpo-36436: Fix _testcapi.pymem_buffer_overflow() (GH-12560)
414b1cd

[miss-islington]

New changeset 20fde53 by Miss Islington (bot) in branch '3.7':
bpo-36436: Fix _testcapi.pymem_buffer_overflow() (GH-12560)
20fde53

[vstinner]

Thanks for your bug report. It is now fixed.