python/cpythonPublic

NotificationsYou must be signed in to change notification settings
Fork34.2k
Star71.8k

gh-145335: Fix crash when passing -1 as fd in os.pathconf#145390

Merged

vstinner merged 4 commits intopython:mainfrom

aisk:pathconf-with-negative-one

Mar 2, 2026

Merged

gh-145335: Fix crash when passing -1 as fd in os.pathconf#145390
vstinner merged 4 commits intopython:mainfrom
aisk:pathconf-with-negative-one

Conversation

Copy link

Member

aisk commentedMar 1, 2026•
edited
Loading

We currently test whetherpath_t.fd is -1 to decide if the argument should be treated as an fd or as a path, and then callfpathconf() orpathconf() according to it.

In the original issue, we passing -1 caused the code incorrectly treats the argument as a real path. But,path->narrow is NULL, so callingpathconf() on it will crash the interpreter.

This change adds a helper that checks whether the original argument is index-like to determine if it's an fd, so we can correctly the behavior and avoid the crash.

There are otheros functions that acceptpath_t and may have the same issue. Since that is outside the scope of the original issue, I think we should fix those in a separate PR.

Issue:Segfault from runningos.pathconf(-1, 1) #145335

Fix crash when passing -1 as fd in os.pathconf

3c693cc

bedevere-appbot mentioned this pull request

Mar 1, 2026

Segfault from runningos.pathconf(-1, 1)#145335

Closed

bedevere-appbot added the awaiting review label

Mar 1, 2026

📜🤖 Added by blurb_it.

bac84ce

picnixz reviewed

Mar 1, 2026

View reviewed changes

Modules/posixmodule.c Outdated

		static bool
		path_is_fd(const path_t *path)
		{
		return path->allow_fd && path->object != NULL && PyIndex_Check(path->object);

Copy link

Member

picnixzMar 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Is the problem really with the check or with is it with the converter?

Copy link

Member

picnixzMar 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

edit: nvm

Copy link

Member

vstinnerMar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Instead of checkingpath->object type (PyIndex_Check()), I would prefer adding apath_t.is_fd member and modifypath_converter() to set this member.

Copy link

MemberAuthor

aiskMar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Updated.

Copy link

Member

vstinner commentedMar 2, 2026

Other functions have the same issues, even if they don't crash:

os.stat(-1)
os.statx(-1, mask=0)
os.chdir(-1)
os.chmod(-1, 0)
os.chown(-1, 0, 0)
os.listdir(-1): current it behaves asos.listdir(os.path.curdir)
os._path_exists(-1) (Windows only)
os._path_lexists(-1) (Windows only)
os._path_isdir(-1) (Windows only)
os._path_isfile(-1) (Windows only)
os._path_islink(-1) (Windows only)
os._path_isjunction(-1) (Windows only)
os.utime(-1, (0, 0))
os.execve(-1, ['/bin/true'], os.environ)
os.truncate(-1, 0)
os.statvfs(-1)
os.pathconf(-1, "PC_NAME_MAX") crash (issueSegfault from runningos.pathconf(-1, 1) #145335)
os.getxattr(-1, "user")
os.setxattr(-1, "user", b"1")
os.removexattr(-1, "user")
os.listxattr(-1): current it behaves asos.listxattr(os.path.curdir)
os.scandir(-1): current it behaves asos.scandir(os.path.curdir)

On Linux (with the glibc), most functions fail withOSError: [Errno 14] Bad address: -1.

This list are functions usingpath_t(allow_fd=True) type in Argument Clinic, or variants such aspath_t(allow_fd='PATH_HAVE_FCHDIR') type.

vstinner reviewed

Mar 2, 2026

View reviewed changes

Lib/test/test_os/test_os.py OutdatedShow resolvedHide resolved

aisk added2 commits

March 3, 2026 01:38

Using is_fd field to determin a path_t is an fd or not

d0ed838

Fix skip messages

43334fa

vstinner approved these changes

Mar 2, 2026

View reviewed changes

Copy link

Member

vstinner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

LGTM

bedevere-appbot added awaiting merge and removed awaiting review labels

Mar 2, 2026

vstinner merged commit5c3a47b intopython:main

Mar 2, 2026

51 checks passed

bedevere-appbot removed the awaiting merge label

Mar 2, 2026

vstinner added needs backport to 3.13

bugs and security fixes

needs backport to 3.14bugs and security fixes labels

Mar 2, 2026

Copy link

miss-islington-appbot commentedMar 2, 2026

Thanks@aisk for the PR, and@vstinner for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

Copy link

miss-islington-appbot commentedMar 2, 2026

Thanks@aisk for the PR, and@vstinner for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

Mar 2, 2026

pythongh-145335: Fix crash when passing -1 as fd in os.pathconf (pyth…

e5a8b05

…onGH-145390)(cherry picked from commit5c3a47b)Co-authored-by: AN Long <aisk@users.noreply.github.com>Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

Mar 2, 2026

pythongh-145335: Fix crash when passing -1 as fd in os.pathconf (pyth…

3a159df

…onGH-145390)(cherry picked from commit5c3a47b)Co-authored-by: AN Long <aisk@users.noreply.github.com>Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>

Copy link

bedevere-appbot commentedMar 2, 2026

GH-145432 is a backport of this pull request to the3.13 branch.

bedevere-appbot removed the needs backport to 3.13bugs and security fixes label

Mar 2, 2026

Copy link

bedevere-appbot commentedMar 2, 2026

GH-145433 is a backport of this pull request to the3.14 branch.

bedevere-appbot removed the needs backport to 3.14bugs and security fixes label

Mar 2, 2026

Copy link

Member

vstinner commentedMar 2, 2026

Merged, thanks for your contribution@aisk.

I'm working on a fix for the other affected functions.

vstinner pushed a commit that referenced this pull request

Mar 2, 2026

[3.13]gh-145335: Fix crash when passing -1 as fd in os.pathconf (GH-…

d305326

…145390) (#145432)gh-145335: Fix crash when passing -1 as fd in os.pathconf (GH-145390)(cherry picked from commit5c3a47b)Co-authored-by: AN Long <aisk@users.noreply.github.com>Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>

vstinner pushed a commit that referenced this pull request

Mar 2, 2026

[3.14]gh-145335: Fix crash when passing -1 as fd in os.pathconf (GH-…

5044368

…145390) (#145433)gh-145335: Fix crash when passing -1 as fd in os.pathconf (GH-145390)(cherry picked from commit5c3a47b)Co-authored-by: AN Long <aisk@users.noreply.github.com>Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>

Copy link

Member

vstinner commentedMar 2, 2026

I wrote#145439 to fix other os functions.

Labels

None yet

Movatterモバイル変換

Uh oh!

Conversation

aisk commentedMar 1, 2026• editedLoading Uh oh!There was an error while loading.Please reload this page.

Uh oh!

Uh oh!

picnixzMar 1, 2026

Choose a reason for hiding this comment

Uh oh!

picnixzMar 1, 2026

Choose a reason for hiding this comment

Uh oh!

vstinnerMar 2, 2026

Choose a reason for hiding this comment

Uh oh!

aiskMar 2, 2026

Choose a reason for hiding this comment

Uh oh!

vstinner commentedMar 2, 2026

Uh oh!

Uh oh!

vstinner left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

miss-islington-appbot commentedMar 2, 2026

Uh oh!

miss-islington-appbot commentedMar 2, 2026

Uh oh!

bedevere-appbot commentedMar 2, 2026

Uh oh!

bedevere-appbot commentedMar 2, 2026

Uh oh!

vstinner commentedMar 2, 2026

Uh oh!

vstinner commentedMar 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

aisk commentedMar 1, 2026•
edited
Loading