gh-156939: Detect buffer overflow in PyBytesWriter in debug mode by vstinner · Pull Request #156943 · python/cpython

vstinner · 2026-09-04T14:46:17Z

Reserve one byte in PyBytesWriter used as a canary byte: set it to a special value. PyBytesWriter_Finish() checks if the canary byte has been overriden. Add a test on the feature.

Update buffer overflow check in fcntl: allocate extra guard bytes in the writer and then truncate these bytes.

Issue: C API: Detect buffer overflow in PyBytesWriter #156939

vstinner · 2026-09-07T15:40:56Z

Oh, the test_xml_etree_c failure is a legit failure: unicode_encode_ucs1() calls with errors="xmlcharrefreplace" writes a NUL byte after the writer buffer. xmlcharrefreplace() calls sprintf(str, "&#%d;", PyUnicode_READ(kind, data, i)) which writes a final NUL byte.

vstinner · 2026-09-07T15:48:46Z

The test_struct error is also a legit bug: a Pascal string of 0 characters writes a NUL byte into an empty buffer, and so triggers a buffer overflow.

vstinner · 2026-09-07T16:00:33Z

On Ubuntu, 8 tests are failing:

8 tests failed:
    test_codeccallbacks test_fcntl test_minidom test_sax test_struct
    test_urllib test_xml_etree test_xml_etree_c

Reserve one byte in PyBytesWriter used as a canary byte: set it to a special value. PyBytesWriter_Finish() checks if the canary byte has been overriden. Add a test on the feature. Update buffer overflow check in fcntl: allocate extra guard bytes in the writer and then truncate these bytes.

vstinner · 2026-09-09T19:49:48Z

I fixed struct.pack() in PR gh-157071 and xmlcharrefreplace in PR gh-157109.

Avoid calling PyBytesWriter_Grow().

vstinner · 2026-09-09T20:43:20Z

cc @serhiy-storchaka

* Add test_get_data_canary() * Update test_get_data()

unicode_encode_ucs1() now calls PyBytesWriter_Grow() to update the PyBytesWriter size.

PyBytesWriter_Grow() no longer calls byteswriter_resize() if grow is smaller than 0.

vstinner · 2026-09-13T00:31:16Z

Android x86_64 fails with:

  ERROR: test_str (test.test_android.TestAndroidOutput.test_str) [stdout]
  ----------------------------------------------------------------------
  Traceback (most recent call last):
    File "/data/user/0/org.python.testbed/files/python/lib/python3.16/test/test_android.py", line 171, in test_str
      write("\ud800\udc00", [r"\ud800\udc00"])
      ~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    File "/data/user/0/org.python.testbed/files/python/lib/python3.16/test/test_android.py", line 148, in write
      self.assertEqual(write_len, stream.write(s))
                                  ~~~~~~~~~~~~^^^
    File "/data/user/0/org.python.testbed/files/python/lib/python3.16/_android_support.py", line 76, in write
      self._write_chunk(chunk)
      ~~~~~~~~~~~~~~~~~^^^^^^^
    File "/data/user/0/org.python.testbed/files/python/lib/python3.16/_android_support.py", line 83, in _write_chunk
      b = s.encode(self.encoding, self.errors)
  ValueError: size larger than allocated size

This error comes from PyBytesWriter_FinishWithSize(): the requested size is too big. I can reproduce it with just:

>>> "\ud800\udc00".encode('utf8', 'backslashreplace')
Traceback (most recent call last):
  File "<python-input-3>", line 1, in <module>
    "\ud800\udc00".encode('utf8', 'backslashreplace')
    ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ValueError: size larger than allocated size

Ah! I forgot to update the UTF-8 encoder.

vstinner · 2026-09-13T00:34:19Z

Ah! I forgot to update the UTF-8 encoder.

I wrote PR gh-157383 for that.

bedevere-bot · 2026-09-13T00:55:24Z

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot aarch64 Android 3.x (tier-3) has failed when building commit 12a1de1.

What do you need to do:

Don't panic.
Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
Go to the page of the buildbot that failed (https://buildbot.python.org/#/builders/1594/builds/5913) and take a look at the build logs.
Check if the failure is related to this commit (12a1de1) or if it is a false positive.
If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/#/builders/1594/builds/5913

Failed tests:

test_android

Failed subtests:

test_str - test.test_android.TestAndroidOutput.test_str

Summary of the results of the build (if available):

==

Click to see traceback logs

Traceback (most recent call last):
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/test/test_android.py", line 171, in test_str
    write("\ud800\udc00", [r"\ud800\udc00"])
    ~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/test/test_android.py", line 148, in write
    self.assertEqual(write_len, stream.write(s))
                                ~~~~~~~~~~~~^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/_android_support.py", line 76, in write
    self._write_chunk(chunk)
    ~~~~~~~~~~~~~~~~~^^^^^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/_android_support.py", line 83, in _write_chunk
    b = s.encode(self.encoding, self.errors)
ValueError: size larger than allocated size
 
======================================================================
ERROR: test_str (test.test_android.TestAndroidOutput.test_str) [stderr]
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/test/test_android.py", line 171, in test_str
    write("\ud800\udc00", [r"\ud800\udc00"])
    ~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/test/test_android.py", line 148, in write
    self.assertEqual(write_len, stream.write(s))
                                ~~~~~~~~~~~~^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/_android_support.py", line 76, in write
    self._write_chunk(chunk)
    ~~~~~~~~~~~~~~~~~^^^^^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/_android_support.py", line 83, in _write_chunk
    b = s.encode(self.encoding, self.errors)
ValueError: size larger than allocated size
 
----------------------------------------------------------------------
Ran 3 tests in 0.081s
 
FAILED (errors=2)


Traceback (most recent call last):
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/test/test_android.py", line 171, in test_str
    write("\ud800\udc00", [r"\ud800\udc00"])
    ~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/test/test_android.py", line 148, in write
    self.assertEqual(write_len, stream.write(s))
                                ~~~~~~~~~~~~^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/_android_support.py", line 76, in write
    self._write_chunk(chunk)
    ~~~~~~~~~~~~~~~~~^^^^^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/_android_support.py", line 83, in _write_chunk
    b = s.encode(self.encoding, self.errors)
ValueError: size larger than allocated size
 
======================================================================
ERROR: test_str (test.test_android.TestAndroidOutput.test_str) [stderr]
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/test/test_android.py", line 171, in test_str
    write("\ud800\udc00", [r"\ud800\udc00"])
    ~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/test/test_android.py", line 148, in write
    self.assertEqual(write_len, stream.write(s))
                                ~~~~~~~~~~~~^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/_android_support.py", line 76, in write
    self._write_chunk(chunk)
    ~~~~~~~~~~~~~~~~~^^^^^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/_android_support.py", line 83, in _write_chunk
    b = s.encode(self.encoding, self.errors)
ValueError: size larger than allocated size
 
----------------------------------------------------------------------
Ran 3 tests in 0.134s
 
FAILED (errors=2)
bytearraymemoryviewmmrve\xc0\x80\xc0\x80�\xc0\x80\xfe\xff\xff\xffaHelloHello world   olé中文😀test test_android failed

bedevere-bot · 2026-09-13T01:51:18Z

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot AMD64 Android 3.x (tier-3) has failed when building commit 12a1de1.

What do you need to do:

Don't panic.
Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
Go to the page of the buildbot that failed (https://buildbot.python.org/#/builders/1591/builds/5239) and take a look at the build logs.
Check if the failure is related to this commit (12a1de1) or if it is a false positive.
If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/#/builders/1591/builds/5239

Failed tests:

test_android

Failed subtests:

test_str - test.test_android.TestAndroidOutput.test_str

Summary of the results of the build (if available):

==

Click to see traceback logs

Traceback (most recent call last):
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/test/test_android.py", line 171, in test_str
    write("\ud800\udc00", [r"\ud800\udc00"])
    ~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/test/test_android.py", line 148, in write
    self.assertEqual(write_len, stream.write(s))
                                ~~~~~~~~~~~~^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/_android_support.py", line 76, in write
    self._write_chunk(chunk)
    ~~~~~~~~~~~~~~~~~^^^^^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/_android_support.py", line 83, in _write_chunk
    b = s.encode(self.encoding, self.errors)
ValueError: size larger than allocated size
 
======================================================================
ERROR: test_str (test.test_android.TestAndroidOutput.test_str) [stderr]
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/test/test_android.py", line 171, in test_str
    write("\ud800\udc00", [r"\ud800\udc00"])
    ~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/test/test_android.py", line 148, in write
    self.assertEqual(write_len, stream.write(s))
                                ~~~~~~~~~~~~^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/_android_support.py", line 76, in write
    self._write_chunk(chunk)
    ~~~~~~~~~~~~~~~~~^^^^^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/_android_support.py", line 83, in _write_chunk
    b = s.encode(self.encoding, self.errors)
ValueError: size larger than allocated size
 
----------------------------------------------------------------------
Ran 3 tests in 0.595s
 
FAILED (errors=2)
bytearraymemoryviewmmrve\xc0\x80\xc0\x80�\xc0\x80\xfe\xff\xff\xffaHelloHello world   olé中文😀test test_android failed


Traceback (most recent call last):
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/test/test_android.py", line 171, in test_str
    write("\ud800\udc00", [r"\ud800\udc00"])
    ~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/test/test_android.py", line 148, in write
    self.assertEqual(write_len, stream.write(s))
                                ~~~~~~~~~~~~^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/_android_support.py", line 76, in write
    self._write_chunk(chunk)
    ~~~~~~~~~~~~~~~~~^^^^^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/_android_support.py", line 83, in _write_chunk
    b = s.encode(self.encoding, self.errors)
ValueError: size larger than allocated size
 
======================================================================
ERROR: test_str (test.test_android.TestAndroidOutput.test_str) [stderr]
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/test/test_android.py", line 171, in test_str
    write("\ud800\udc00", [r"\ud800\udc00"])
    ~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/test/test_android.py", line 148, in write
    self.assertEqual(write_len, stream.write(s))
                                ~~~~~~~~~~~~^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/_android_support.py", line 76, in write
    self._write_chunk(chunk)
    ~~~~~~~~~~~~~~~~~^^^^^^^
  File "/data/user/0/org.python.testbed/files/python/lib/python3.16/_android_support.py", line 83, in _write_chunk
    b = s.encode(self.encoding, self.errors)
ValueError: size larger than allocated size
 
----------------------------------------------------------------------
Ran 3 tests in 0.228s
 
FAILED (errors=2)

bedevere-app Bot mentioned this pull request Sep 4, 2026

C API: Detect buffer overflow in PyBytesWriter #156939

Open

vstinner mentioned this pull request Sep 7, 2026

gh-156939: Fix memory corruption check in fcntl #157103

Closed

vstinner force-pushed the writer_canary branch from 42640e3 to 89a8ac9 Compare September 9, 2026 19:38

vstinner mentioned this pull request Sep 9, 2026

gh-156939: Fix xmlcharrefreplace() buffer overflow #157109

Merged

Skip test_canary_byte on release build

95e3701

Cleanup test_canary_byte()

0dbd2cc

Avoid calling PyBytesWriter_Grow().

vstinner added the topic-C-API label Sep 9, 2026

vstinner marked this pull request as ready for review September 9, 2026 20:42

bedevere-app Bot added the awaiting core review label Sep 9, 2026

Merge branch 'main' into writer_canary

1f1d878

vstinner mentioned this pull request Sep 11, 2026

gh-157242: Fix PyBytesWriter_Resize() on MemoryError #157243

Merged

vstinner added 3 commits September 12, 2026 19:21

Merge branch 'main' into writer_canary

c81cbd7

Rewrite canary byte test in Python

7994e4e

* Add test_get_data_canary() * Update test_get_data()

Change fatal error message

19fdcb4

vstinner enabled auto-merge (squash) September 12, 2026 17:46

vstinner added 5 commits September 12, 2026 22:16

Merge branch 'main' into writer_canary

1084787

pythongh-156939: Do no modify writer->size directly in UCS1 encoder

dc79819

unicode_encode_ucs1() now calls PyBytesWriter_Grow() to update the PyBytesWriter size.

Update get_data() tests for canary byte

e14b81c

Skip canary byte tests on release build

e029931

Add test_grow_error()

276c315

PyBytesWriter_Grow() no longer calls byteswriter_resize() if grow is smaller than 0.

vstinner merged commit 12a1de1 into python:main Sep 13, 2026
53 of 54 checks passed

vstinner deleted the writer_canary branch September 13, 2026 00:28

bedevere-app Bot removed the awaiting core review label Sep 13, 2026

Navigation Menu

Uh oh!

Uh oh!

gh-156939: Detect buffer overflow in PyBytesWriter in debug mode - #156943

gh-156939: Detect buffer overflow in PyBytesWriter in debug mode#156943
vstinner merged 12 commits into
python:mainfrom
vstinner:writer_canary

vstinner commented Sep 4, 2026 •

edited

Loading

Uh oh!

vstinner commented Sep 7, 2026

Uh oh!

vstinner commented Sep 7, 2026

Uh oh!

vstinner commented Sep 7, 2026

Uh oh!

vstinner commented Sep 9, 2026

Uh oh!

vstinner commented Sep 9, 2026

Uh oh!

Uh oh!

vstinner commented Sep 13, 2026

Uh oh!

vstinner commented Sep 13, 2026

Uh oh!

bedevere-bot commented Sep 13, 2026

Uh oh!

bedevere-bot commented Sep 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

vstinner commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vstinner commented Sep 7, 2026

Uh oh!

vstinner commented Sep 7, 2026

Uh oh!

vstinner commented Sep 7, 2026

Uh oh!

vstinner commented Sep 9, 2026

Uh oh!

vstinner commented Sep 9, 2026

Uh oh!

Uh oh!

vstinner commented Sep 13, 2026

Uh oh!

vstinner commented Sep 13, 2026

Uh oh!

bedevere-bot commented Sep 13, 2026

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Uh oh!

bedevere-bot commented Sep 13, 2026

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vstinner commented Sep 4, 2026 •

edited

Loading