Skip to content

gh-148093: Raise binascii.Error from binascii.a2b_uu on empty input #149077

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
maurycy wants to merge 6 commits into
base: main
Choose a base branch
from
+17 −0
Open

gh-148093: Raise binascii.Error from binascii.a2b_uu on empty input #149077

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
dbe9f9c
fix mit blurb
maurycy Apr 27, 2026
8a1a5c2
test
maurycy Apr 27, 2026
42749c7
better error msg
maurycy Apr 27, 2026
c0255da
better blurb
maurycy Apr 27, 2026
6777a45
smaller diff
maurycy Apr 27, 2026
27cdd4f
i should go to sleep
maurycy Apr 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions Lib/test/test_binascii.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1306,6 +1306,10 @@ def test_uu(self):
self.assertEqual(binascii.a2b_uu(b"\xff"), b"\x00"*31)
self.assertRaises(binascii.Error, binascii.a2b_uu, b"\xff\x00")
self.assertRaises(binascii.Error, binascii.a2b_uu, b"!!!!")
self.assertRaises(binascii.Error, binascii.a2b_uu,
self.type2test(b""))
self.assertRaises(binascii.Error, binascii.a2b_uu,
Copy link
Copy Markdown
Contributor

@sethmlarson sethmlarson Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need this second test case? The [:0] makes it an empty sequence?

Copy link
Copy Markdown
Contributor Author

@maurycy maurycy Apr 27, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sethmlarson

cpython/Lib/test/test_binascii.py

Lines 1622 to 1623 in 005555a

class MemoryviewBinASCIITest(BinASCIITest):
type2test = memoryview

memoryview(b"#86)C")[:0] is the actual UB case here: zero slice with larger underlying buffer

@serhiy-storchaka came up with it:

#148093 (comment)

Truth to be told, this BinASCIITest inheritance is very confusing and make lots of tests without self.type2test redundant but I didn't want to overhaul it. Do you want me to create a separate issue documenting problems with BinASCIITest?

self.type2test(b"#86)C")[:0])
self.assertRaises(binascii.Error, binascii.b2a_uu, 46*b"!")

# Issue #7701 (crash on a pydebug build)
Expand Down Expand Up @@ -1522,6 +1526,9 @@ def test_empty_string(self):
binascii.crc_hqx(empty, 0)
continue
f = getattr(binascii, func)
if func == 'a2b_uu':
self.assertRaises(binascii.Error, f, empty)
continue
try:
f(empty)
except Exception as err:
Expand Down
2 changes: 2 additions & 0 deletions Misc/NEWS.d/next/Library/2026-04-27-22-34-09.gh-issue-148093.9pWceM.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
Fix an out-of-bounds read of one byte in :func:`binascii.a2b_uu`. Raise
:exc:`binascii.Error`, instead of reading past the buffer end.
8 changes: 8 additions & 0 deletions Modules/binascii.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,14 @@ binascii_a2b_uu_impl(PyObject *module, Py_buffer *data)
assert(ascii_len >= 0);

/* First byte: binary data length (in bytes) */
if (ascii_len == 0) {
state = get_binascii_state(module);
if (state == NULL) {
return NULL;
}
PyErr_SetString(state->Error, "Missing length byte");
return NULL;
}
bin_len = (*ascii_data++ - ' ') & 077;
ascii_len--;

Expand Down
Loading