Skip to content

Commit c70ddb9

Browse files
committed
Fix PyBytesWriter_Discard()
Reset the trailing byte before destroying the bytes/bytearray object.
1 parent 38c822a commit c70ddb9

1 file changed

Lines changed: 15 additions & 8 deletions

File tree

Objects/bytesobject.c

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3665,6 +3665,19 @@ byteswriter_write_canary_byte(PyBytesWriter *writer)
36653665
unsigned char *data = (unsigned char*)byteswriter_data(writer);
36663666
data[writer->size] = PyBytesWriter_CANARY_BYTE;
36673667
}
3668+
3669+
3670+
static void
3671+
byteswriter_reset_trailing_byte(PyBytesWriter *writer)
3672+
{
3673+
if (writer->obj != NULL) {
3674+
// byteswriter_write_canary_byte() can override the trailing NUL byte.
3675+
// So reset the trailing NUL byte to NUL.
3676+
Py_ssize_t allocated = byteswriter_allocated(writer);
3677+
char *data = byteswriter_data(writer);
3678+
data[allocated] = '\0';
3679+
}
3680+
}
36683681
#endif
36693682

36703683

@@ -3814,6 +3827,7 @@ PyBytesWriter_Discard(PyBytesWriter *writer)
38143827

38153828
#ifdef Py_DEBUG
38163829
byteswriter_check_canary_byte(writer);
3830+
byteswriter_reset_trailing_byte(writer);
38173831
#endif
38183832

38193833
Py_XDECREF(writer->obj);
@@ -3840,14 +3854,7 @@ PyBytesWriter_FinishWithSize(PyBytesWriter *writer, Py_ssize_t size)
38403854
#ifdef Py_DEBUG
38413855
// Check for buffer overflow
38423856
byteswriter_check_canary_byte(writer);
3843-
3844-
if (writer->obj != NULL) {
3845-
// byteswriter_write_canary_byte() can override the trailing NUL byte.
3846-
// So reset the trailing NUL byte to NUL.
3847-
Py_ssize_t allocated = byteswriter_allocated(writer);
3848-
char *data = byteswriter_data(writer);
3849-
data[allocated] = '\0';
3850-
}
3857+
byteswriter_reset_trailing_byte(writer);
38513858
#endif
38523859

38533860
PyObject *result;

0 commit comments

Comments
 (0)